Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
MayitaV16.exe

Overview

General Information

Sample name:MayitaV16.exe
Analysis ID:1560584
MD5:e5bb039da501cae7edddf9268ec43741
SHA1:a7571b4b9a2c93187f20bf4de5d7852154b15216
SHA256:e92d4f3c94a734fb23d91270012fe3c13f566d1f3d6b7ec166bd30666cd2b036
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption
Drops large PE files
Tries to harvest and steal browser information (history, passwords, etc)
Creates a process in suspended mode (likely to inject code)
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables security privileges
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries keyboard layouts
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Browser Started with Remote Debugging
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses taskkill to terminate processes
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • MayitaV16.exe (PID: 7396 cmdline: "C:\Users\user\Desktop\MayitaV16.exe" MD5: E5BB039DA501CAE7EDDDF9268EC43741)
  • MayitaV16.exe (PID: 7840 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe" MD5: DF1D5E605E98A3A533E6AD7E585442E0)
    • cmd.exe (PID: 8136 cmdline: C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WMIC.exe (PID: 8188 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
    • MayitaV16.exe (PID: 1052 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: DF1D5E605E98A3A533E6AD7E585442E0)
    • MayitaV16.exe (PID: 2800 cmdline: "C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2348 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: DF1D5E605E98A3A533E6AD7E585442E0)
    • chrome.exe (PID: 2720 cmdline: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 5820 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2020 --field-trial-handle=1984,i,3138843665654156619,11594928844437088871,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • msedge.exe (PID: 7684 cmdline: "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000 MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 5184 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2116 --field-trial-handle=1972,i,14171082060860887493,6740327589289574467,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 8560 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --no-sandbox --mojo-platform-channel-handle=5364 --field-trial-handle=1972,i,14171082060860887493,6740327589289574467,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • cmd.exe (PID: 8616 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tasklist.exe (PID: 8680 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
    • cmd.exe (PID: 8640 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tasklist.exe (PID: 8764 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
    • cmd.exe (PID: 8668 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tasklist.exe (PID: 8776 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
    • cmd.exe (PID: 8852 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 8892 cmdline: taskkill /IM EpicGamesLauncher.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)
    • cmd.exe (PID: 8900 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 8984 cmdline: taskkill /F /T /IM chrome.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)
    • cmd.exe (PID: 8924 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 9072 cmdline: taskkill /F /T /IM chrome.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)
    • cmd.exe (PID: 8992 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 9004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 9088 cmdline: taskkill /F /T /IM chrome.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)
    • cmd.exe (PID: 9136 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 9144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 9184 cmdline: taskkill /IM javaw.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)
    • cmd.exe (PID: 9212 cmdline: C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 1312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 6204 cmdline: taskkill /IM Steam.exe /F MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)
    • cmd.exe (PID: 7760 cmdline: C:\Windows\system32\cmd.exe /d /s /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 3248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tasklist.exe (PID: 5272 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Browser Started with Remote Debugging
Source: Process startedAuthor: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000, CommandLine: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000, CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe" , ParentImage: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe, ParentProcessId: 7840, ParentProcessName: MayitaV16.exe, ProcessCommandLine: "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000, ProcessId: 2720, ProcessName: chrome.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_230c0e73-8
Source: MayitaV16.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\MayitaV16.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ab644055-b4e9-5f6e-a5b5-ef13859cd8b1Jump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Programs\unrealgame\LICENSE.electron.txtJump to behavior
Source: MayitaV16.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: 'ProgramDataBaseFileName': '$(IntDir)\\vc90b.pdb', source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: pdb_base = '%s.%s.pdb' % (pdb_base, TARGET_TYPE_EXT[target_dict['type']]) source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: pdbpath_cc = pdbpath + '.cc.pdb' source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: MayitaV16.exe, 00000000.00000003.1916544111.0000000002B34000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: pdb = self.GetPDBName(config, expand_special, output_name + '.pdb') source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: pdbpath_c = pdbpath + '.c.pdb' source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: # the .pdb by the precompiled header step for .cc and the compilation of source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: MayitaV16.exe, 00000000.00000003.1858941135.00000000051E5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: - Use '<(PRODUCT_DIR)/<(product_name).(exe|dll).pdb' if 'product_name' is source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 'ProgramDatabaseFile': 'Flob.pdb', source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: - Use '<(PRODUCT_DIR)/<(target_name).(exe|dll).pdb'. source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: config_name, self.ExpandSpecial, output + '.pdb') source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: MayitaV16.exe, 00000000.00000003.1860288601.00000000051EC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: MayitaV16.exe, 00000000.00000003.1858941135.00000000051E5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\electron.exe.pdb source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 'ProgramDataBaseFileName': '$(IntDir)vc90b.pdb', source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1911988645.00000000051EC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: MayitaV16.exe, 00000000.00000003.1778684027.0000000006930000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: config_name, self.ExpandSpecial, output + '.pdb') source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: '$(IntDir)$(ProjectName)\\vc80.pdb', only_if_unset=True) source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: # See comment at cc_command for why there's two .pdb files. source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: MayitaV16.exe, 00000000.00000003.1856211062.0000000005BE0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1854051189.0000000005490000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1853858810.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1912128736.0000000002B34000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\MayitaV16.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile opened: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile opened: C:\Users\user\AppData\Local\Programs\unrealgameJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile opened: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: chrome.exeMemory has grown: Private usage: 12MB later: 27MB
Source: Joe Sandbox ViewIP Address: 172.67.169.156 172.67.169.156
Source: Joe Sandbox ViewIP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox ViewIP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox ViewIP Address: 45.112.123.126 45.112.123.126
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: * **Google Hangouts Video**: http://www.youtube.com/watch?v=I9nDOSGfwZg equals www.youtube.com (Youtube)
Source: global trafficDNS traffic detected: DNS query: hexon.fun
Source: global trafficDNS traffic detected: DNS query: api.gofile.io
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global trafficDNS traffic detected: DNS query: ntp.msn.com
Source: unknownHTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://2x.io)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.izs.me)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://blog.izs.me/)
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://certificates.godaddy.com/repository100.
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cgit.freedesktop.org/xorg/xserver/tree/COPYING
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://christalkington.com/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cldr.unicode.org/index/downloads
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/smhasher/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.google.com/p/v8
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cr.yp.to/djb.html
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.godaddy.com/gds1-20
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dev.w3.org/2006/webapi/XMLHttpRequest-2/Overview.html#the-formdata-interface
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://devel.freebsoft.org/speechd
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://developer.android.com/tools/extras/support-library.html
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/uuid.html
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://dominictarr.com)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://encoding.spec.whatwg.org/#big5-encoder
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/common
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://exslt.org/commonnode-set..
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fedorahosted.org/lohit&gt;
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://feross.org
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://form-data.github.io/images/gitterbadge.svg)
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://freedesktop.org
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://git.linuxtv.org/v4l-utils.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/garycourt/uri-js
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.github.io/snappy/
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://hyperelliptic.org/tanja
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://icl.com/saxon
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://icl.com/saxonorg.apache.xalan.xslt.extensions.RedirectxsltDocumentElem:
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://icu-project.org/docs/papers/gb18030.html
Source: MayitaV16.exe, 00000000.00000003.1916544111.0000000002B34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://int3.de/
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://juliangruber.com
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://labs.creativecommons.org/licenses/zero-waive/1.0/us/legalcode&gt;
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ljharb.codes
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://localhosthttp://127.0.0.1object-src
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://me.abelcheung.org/articles/research/what-is-cp951/
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://moztw.org/docs/big5/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mxr.mozilla.org/comm-central/source/mozilla/netwerk/base/src/nsURLParsers.cpp
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://n8.io/)
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://narwhaljs.org)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://npm.im/minipass)
Source: MayitaV16.exe, 00000000.00000000.1689311795.000000000040A000.00000008.00000001.01000000.00000003.sdmp, MayitaV16.exe, 00000000.00000002.1963522660.000000000040A000.00000004.00000001.01000000.00000003.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.godaddy.com/0J
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://pajhome.org.uk/crypt/md5
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://re-becca.org/)
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://s..
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://scripts.sil.org/OFL
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://semver.org/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://source.android.com/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://source.android.com/compatibility)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://source.icu-project.org/repos/icu/data/trunk/charset/data/xml/gb-18030-2000.xml
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/xz/COPYING
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/16459606/376773
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/22747272/680742
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/a/398120/376773
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://substack.net)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tanyabrassie.com/
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc3501#section-5.1.3
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc3501#section-5.1.3)
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tukaani.org/xz/
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tweetnacl.cr.yp.to/
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tweetnacl.cr.yp.to/)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://unlicense.org
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://unlicense.org/)
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://userguide.icu-project.org/strings/properties
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://valgrind.org
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://webkit.org/
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://wiki.whatwg.org/wiki/Crypto
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.chromium.org
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.cryptojedi.org/users/peter/
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ru.nl/~sjakie/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.freedesktop.org/wiki/Software/xdg-user-dirs
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.futurealoof.com)
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gutenberg.org/ebooks/53).
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.haible.de/bruno/charsets/conversion-tables/Big5.html
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.jclark.com/xt
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.joyent.com
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.khngai.com/chinese/charmap/tblgbk.php?page=0
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.linux-usb.org/usb-ids.html
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.movable-type.co.uk/scripts/sha1.html
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/MPL/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.nongnu.org/freebangfont/downloads.html#mukti
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ogcio.gov.hk/en/business/tech_promotion/ccli/terms/doc/2003cmp_2008.txt
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ogcio.gov.hk/tc/business/tech_promotion/ccli/terms/doc/hkscs-2008-big5-iso.txt
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ploscompbiol.org/static/license
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.squid-cache.org/Doc/config/half_closed_clients/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.strongtalk.org/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.suitable.com
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.suitable.com/tools/smslib.html
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.suitable.com/tools/smslib.html&gt;
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/OTHER/BIG5.TXT)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT
Source: MayitaV16.exe, 00000000.00000003.1755606463.0000000005DE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.unicode.org/copyright.html
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.unix.org/Public/UNIDATA/EastAsianWidth.txt
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.webrtc.org
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/watch?v=I9nDOSGfwZg
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www8.plala.or.jp/tkubota1/unicode-symbols-map2.html
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xmlsoft.org/XSLT/
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xmlsoft.org/XSLT/namespace
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xmlsoft.org/XSLT/namespacehttp://www.jclark.com/xtxsl:key
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://xmlsoft.org/XSLT/xsltNewExtDef
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://zlib.net/
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://android.com/pay
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/upload
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons.gcp.gvt2.com/domainreliability/uploadhttps://beacons.gvt2.com/domainreliability/uplo
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons.gvt2.com/domainreliability/upload
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons2.gvt2.com/domainreliability/upload
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons3.gvt2.com/domainreliability/upload
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons4.gvt2.com/domainreliability/upload
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons5.gvt2.com/domainreliability/upload
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://beacons5.gvt3.com/domainreliability/upload
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bit.ly/audio-worklet)
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bit.ly/audio-worklet)ScriptProcessorHandler::ProcessScriptProcessorHandler::Process
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://blueimp.net
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=10201
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.chromium.org/p/v8/issues/detail?id=3175#c4
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=162431
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=310299
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=695438).
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=745678
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=912470#c31
Source: MayitaV16.exe, 00000000.00000003.1912812737.0000000002B34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u
Source: MayitaV16.exe, 00000000.00000003.1915246930.0000000002B34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=sr&category=theme81https://myactivity.google.com/myactivity/?u
Source: MayitaV16.exe, 00000000.00000003.1916544111.0000000002B34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/vulkan-deps/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/webm/libwebm
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromium.googlesource.com/webm/libwebp
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/domainreliability/upload
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#clear
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#console-namespace
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#count
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#count-map
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#countreset
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://console.spec.whatwg.org/#table
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cr.joyent.us)
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1144908
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1144908.
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1144908.The
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1144908Changing
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/1393662).
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/v8/7848
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://creativecommons.org/licenses/by-sa/4.0/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://creativecommons.org/licenses/by/3.0/
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cs.chromium.org/chromium/src/v8/tools/SourceMap.js?rcl=dd10454c1d
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling.
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7231#section-6.4
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc7238
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dejavu-fonts.github.io/Download.html
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Tools/Web_Console#Styling_messages
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/PerformanceResourceTiming
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equa
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/android/guides/setup
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/d/17aTgLnjMXIrfjgNaTUnHQO7m3xgzHR2VXBTmi03Qii4/
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunk
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org/#encode-and-flush
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org/#textdecoder
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org/#textencoder
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://encoding.spec.whatwg.org/#utf-8-decoder
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://esdiscuss.org/topic/isconstructor#content-11
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://example.org
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://example.orgExpired
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://feross.org/support
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fetch.spec.whatwg.org/#fetch-timing-info
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/XVilka/8346728#gistcomment-2823421
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ChromiumWebApps/chromium/blob/b3d3b4da8bb94c1b2e061600df106d590fda3620/net/cookie
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Cyan4973/xxHash
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/GoogleChromeLabs/text-fragments-polyfill
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Cross
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Headers.git
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/SPIRV-Tools.git
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Headers
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/KhronosGroup/Vulkan-Loader
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/LiosK/UUID.js
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Qix-/color-convert/blob/3f0e0d4e92e235796ccb17f6e85c72094a651f49/conversions.js
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify#readme
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/RyanZim/universalify.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/STRML/async-limiter
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Squirrel/Squirrel.Mac
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/TooTallNate/util-deprecate
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WICG/scheduling-apis
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebAssembly/esm-integration/issues/42
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.md
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/aawc/unrar.git
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/addaleax/eventemitter-asyncresource
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/andyperlitch/jsbn.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/archiverjs/node-compress-commons
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/archiverjs/node-zip-stream
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/archiverjs/node-zip-stream.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/archiverjs/node-zip-stream/blob/master/LICENSE
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ashtuchkin/iconv-lite
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Javascript-source-file-encodings
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Node-v4-compatibility
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ashtuchkin/iconv-lite/wiki/Use-Buffers-when-decoding
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/blueimp/JavaScript-MD5
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/browserify/node-util
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/ansi-regex/blob/HEAD/index.js
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/ansi-styles?sponsor=1
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/strip-ansi?sponsor=1
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/supports-color
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chalk/wrap-ansi?sponsor=1
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorith
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/da-x/rxvt-unicode/tree/v9.22-with-24bit-color
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/davepacheco/javascriptlint
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/davepacheco/jsstyle
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dchest/tweetnacl-js.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dchest/tweetnacl-util-js
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/defunctzombie/node-util
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dominictarr/varstruct
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/dominictarr/varstruct.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/facebook/react-native/pull/1632
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/buffer
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/buffer/issues/154
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/buffer/issues/166
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/buffer/issues/219
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/buffer/pull/148
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/feross/safe-buffer
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/floodyberry/poly1305-donna
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/floodyberry/poly1305-donna)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/garycourt/uri-js
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.js
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/startSES.js
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/closure-compiler/wiki/Source-Maps
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/diff-match-patch/tree/master/javascript
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/distributed_point_functions
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/google-api-cpp-client/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/ruy
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/ukey2
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/woff2
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/wuffs-mirror-release-c
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/xnnpack
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/heycam/webidl/pull/946.
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/holepunchto/text-decoder#readme
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/holepunchto/text-decoder.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iarna/wide-align
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/101)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/102)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/105)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/106
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/issues/99)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/iojs/readable-stream/labels/wg-agenda
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/color-support.
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/minipass.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/minizlib.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/node-glob/issues/167
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/node-glob/issues/205
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/isaacs/yallist.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/eng/blob/master/docs/index.md)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/joyent-gerrit/blob/master/docs/user/README.md).
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/juliangruber/brace-expansion
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/juliangruber/isarray
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/libuv/libuv/pull/1501.
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/end-of-stream
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/pump
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-stream
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mafintosh/tar-stream.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mathiasbynens/emoji-regex.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mikeal/tunnel-agent
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/mysticatea/abort-controller
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/TSC/blob/master/Moderation-Policy.md
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/io.js/blob/cff7300a578be1b10001f2d967aaedc88aee6402/lib/readline.js#L1345
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/io.js/blob/cff7300a578be1b10001f2d967aaedc88aee6402/lib/readline.js#L1369
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node-v0.x-archive/issues/2876.
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/master/CODE_OF_CONDUCT.md
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/blob/v10.8.0/lib/internal/errors.js
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/commit/112cc7c27551254aa2b17098fb774867f05ed0d9
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/commit/ec2822adaad76b126b5cccdeaa1addf2376c9aa6
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/10673
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/13435
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/19009
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/34532
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/35452
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/35475
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/35862
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/35981
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/39707
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/39758
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/45699
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/issues/8871#issuecomment-250915913
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/12607
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/21313
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/26334.
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/30380#issuecomment-552948364
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/30958
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/32887
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/33515.
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/33661
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/34010
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/34103#issuecomment-652002364
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/34375
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/34385
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/35941
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/35949#issuecomment-722496598
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/36061#discussion_r533718029
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/38248
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/38433#issuecomment-828426932
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/38614)
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/43714
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/44952
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/node/pull/46161
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nodejs/string_decoder
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/fs-minipass#readme
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/fs-minipass.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-semver
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-semver.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-tar.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-tar/blob/51b6627a1f357d2eb433e7378e5f05e83b7aa6cd/lib/header.js#L349
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-tar/issues/183
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/node-tar/pull/187
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/nopt.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/npm/wrappy
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/salesforce/tough-cookie
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sindresorhus/p-is-promise/blob/cda35a513bda03f977ad5cde3a079d237e82d7ef/index.js
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/feross
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/isaacs
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/ljharb
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/standard-things/esm/issues/821.
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/stash
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/substack/node-mkdirp.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tapjs/signal-exit
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tapjs/signal-exit.git
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/ecma262/blob/HEAD/LICENSE.md
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/ecma262/issues/1209
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/proposal-iterator-helpers/issues/169
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/proposal-ses/blob/e5271cc42a257a05dcae2fd94713ed2f46c08620/shim/src/freeze.j
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tc39/proposal-weakrefs
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/models
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/tensorflow
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/text.git
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/tflite-support
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/uuidjs/uuid.git
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/gamepad/pull/120
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/gamepad/pull/120Access
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-featuresDeviceOri
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/wasdk/wasmparser
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/web-animations/web-animations-js
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws.git
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1202
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1869.
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/websockets/ws/issues/1940.
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/yetingli
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.freedesktop.org/wayland/weston
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.freedesktop.org/xdg/xdgmime
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitlab.freedesktop.org/xorg/proto/xproto/
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitter.im/form-data/form-data
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gitter.im/form-data/form-data)
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/4NeimX
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/7K7WLu
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/7K7WLuThe
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/7K7WLuWebAudio.AutoplayWebAudio.Autoplay.CrossOriginWebAudio.Autoplay.UnlockType..
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/EuHzyv
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/HxfxSQ
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/J6ASzs
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goo.gl/t5IS6M).
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google.com/pay
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google.com/payhttps://android.com/paysecure-payment-confirmationAppStoreBillingPlaceHolderZZ
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#Replaceable
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#define-the-operations
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#dfn-class-string
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-interfaces
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-namespaces
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-operations
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequentlyOut
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/comms.html#the-websocket-interface
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setinterval
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/webappapis.html#windoworworkerglobalscope
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/appveyor/ci/alexindigo/form-data/master.svg?label=windows:4.x-9.x)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/npm/v/form-data.svg)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/travis/form-data/form-data/master.svg?label=linux:4.x-9.x)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/travis/form-data/form-data/master.svg?label=macos:4.x-9.x)
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://infra.spec.whatwg.org/#forgiving-base64
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://infra.spec.whatwg.org/#forgiving-base64-decode
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://istanbul.js.org/
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://linux.die.net/man/1/dircolors).
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mathiasbynens.be/
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mths.be/emoji
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mths.be/emoji-regex
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://no-color.org/
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode).
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/fs.html
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/fs.html#fs_stat_time_values)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nodejs.org/api/zlib.html#zlib_class_options
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://opensource.org/licenses/MIT
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pagure.io/lohit
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://play.google.com/billing
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://play.google.com/billingQuota
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap12.html).
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://semver.org/
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sindresorhus.com
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sindresorhus.com)
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/site/gaviotachessengine/Home/endgame-tablebases-1
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://source.chromium.org/chromium/chromium/src/
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sourceforge.net/projects/wtl/files/WTL%2010/
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sourcemaps.info/spec.html
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sqlite.org/
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/a/5501711/3561
Source: MayitaV16.exe, 00000000.00000003.1913537198.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1915420712.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916544111.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913719069.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1915338616.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914021068.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914360554.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914233029.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914678988.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913261780.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913341916.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913604749.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913073283.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914504169.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914124365.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913892148.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913406165.0000000002B34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: MayitaV16.exe, 00000000.00000003.1912812737.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913719069.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1915338616.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914021068.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914360554.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914233029.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914678988.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913261780.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913814892.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913341916.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913604749.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913073283.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914504169.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914124365.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913892148.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913406165.0000000002B34000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swiftshader.googlesource.com/SwiftShader
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#sec-%typedarray%-intrinsic-object
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#sec-timeclip
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.es/ecma262/#table-typeof-operator-results
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-%typedarray%.of
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://testanything.org/tap-version-14-specification.html
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://testanything.org/tap-version-14-specification.html#subtests
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2152
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2397#section-2
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.2.2
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc6455#section-1.3
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc6455#section-9.1
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.6
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://travis-ci.org/form-data/form-data)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tweetnacl.js.org
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#cannot-have-a-username-password-port
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#forbidden-host-code-point
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#special-scheme
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#url
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#url-serializing
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://v8.dev/blog/v8-release-89
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/manifest/#installability-signals
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/resource-timing/#dfn-mark-resource-timing
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/resource-timing/#dfn-setup-the-resource-timing-entry
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/resource-timing/#dom-performance-setresourcetimingbuffersize
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/webappsec-subresource-integrity/#the-integrity-attribute
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webassembly.github.io/spec/web-api
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webidl.spec.whatwg.org/#es-dictionary
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://webrtc.googlesource.com/src/
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bluetooth.com/specifications/gatt/characteristics
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bluetooth.com/specifications/gatt/descriptors
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.bluetooth.com/specifications/gatt/services
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5644273861001216.
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5682658461876224.
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.chromestatus.com/feature/5718547946799104
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.cl.cam.ac.uk/%7Emgk25/ucs/utf8_check.c
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-line-terminators
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ecma-international.org/ecma-262/#sec-promise.all
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.iana.org/assignments/tls-extensiontype-values
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.npmjs.com/package/form-data)
Source: MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.patreon.com/feross
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc9110#section-5.2
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.swift.org/download/
Source: MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.unicode.org/copyright.html.
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: GetRawInputDatamemstr_fc6ae329-b

System Summary

barindex
Drops large PE files
Source: C:\Users\user\Desktop\MayitaV16.exeFile dump: MayitaV16.exe.0.dr 162117120Jump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile dump: MayitaV16.exe0.0.dr 162117120Jump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeProcess token adjusted: SecurityJump to behavior
Source: MayitaV16.exe0.0.drStatic PE information: Number of sections : 15 > 10
Source: libEGL.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: MayitaV16.exe.0.drStatic PE information: Number of sections : 15 > 10
Source: libGLESv2.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: vk_swiftshader.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: libGLESv2.dll0.0.drStatic PE information: Number of sections : 11 > 10
Source: vulkan-1.dll.0.drStatic PE information: Number of sections : 11 > 10
Source: libEGL.dll0.0.drStatic PE information: Number of sections : 11 > 10
Source: MayitaV16.exe, 00000000.00000003.1858941135.00000000051E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs MayitaV16.exe
Source: MayitaV16.exe, 00000000.00000003.1916544111.0000000002B34000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameElevate.exeH vs MayitaV16.exe
Source: MayitaV16.exe, 00000000.00000003.1864468245.00000000051EC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dllb! vs MayitaV16.exe
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevk_swiftshader.dll, vs MayitaV16.exe
Source: MayitaV16.exe, 00000000.00000003.1775992920.0000000006956000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamed3dcompiler_47.dllj% vs MayitaV16.exe
Source: MayitaV16.exe, 00000000.00000003.1869399976.00000000051EB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename4 vs MayitaV16.exe
Source: MayitaV16.exe, 00000000.00000003.1856780835.0000000006E70000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilename4 vs MayitaV16.exe
Source: MayitaV16.exe, 00000000.00000003.1778684027.0000000006930000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dllb! vs MayitaV16.exe
Source: MayitaV16.exe, 00000000.00000003.1911988645.00000000051EC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevk_swiftshader.dll, vs MayitaV16.exe
Source: MayitaV16.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: sln_path = build_file_root + options.suffix + '.sln'
Source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: sln_path = os.path.splitext(build_file)[0] + options.suffix + '.sln'
Source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: """Generate .sln and .vcproj files.
Source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: # GUID is the same whether it's included from base/base.sln or
Source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: # foo/bar/baz/baz.sln.
Source: classification engineClassification label: mal56.troj.spyw.winEXE@93/213@8/6
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8944:120:WilError_03
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9004:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8624:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8700:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8916:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8656:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9144:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3248:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8860:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1312:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8148:120:WilError_03
Source: C:\Users\user\Desktop\MayitaV16.exeMutant created: \Sessions\1\BaseNamedObjects\ab644055-b4e9-5f6e-a5b5-ef13859cd8b1
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse784E.tmpJump to behavior
Source: MayitaV16.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;EpicGamesLauncher.exe&quot;)
Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;javaw.exe&quot;)
Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;Steam.exe&quot;)
Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\MayitaV16.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT name FROM sqlite_master WHERE type='table';
Source: C:\Users\user\Desktop\MayitaV16.exeFile read: C:\Users\user\Desktop\MayitaV16.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\MayitaV16.exe "C:\Users\user\Desktop\MayitaV16.exe"
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe "C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe"
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe "C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe "C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2348 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2020 --field-trial-handle=1984,i,3138843665654156619,11594928844437088871,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2116 --field-trial-handle=1972,i,14171082060860887493,6740327589289574467,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --no-sandbox --mojo-platform-channel-handle=5364 --field-trial-handle=1972,i,14171082060860887493,6740327589289574467,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM chrome.exe
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM chrome.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM chrome.exe
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM javaw.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Steam.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe "C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe "C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2348 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuidJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2020 --field-trial-handle=1984,i,3138843665654156619,11594928844437088871,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2116 --field-trial-handle=1972,i,14171082060860887493,6740327589289574467,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --no-sandbox --mojo-platform-channel-handle=5364 --field-trial-handle=1972,i,14171082060860887493,6740327589289574467,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM chrome.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM chrome.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM chrome.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM javaw.exe /F
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Steam.exe /F
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: ffmpeg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: resourcepolicyclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: msmpeg2vdec.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: mfperfhelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dxva2.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: msvproc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeSection loaded: rasadhlp.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: version.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: version.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: version.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: version.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: version.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: profapi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: version.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exeSection loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: version.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exeSection loaded: profapi.dll
Source: C:\Users\user\Desktop\MayitaV16.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\MayitaV16.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ab644055-b4e9-5f6e-a5b5-ef13859cd8b1Jump to behavior
Source: MayitaV16.exeStatic file information: File size 79067379 > 1048576
Source: MayitaV16.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: 'ProgramDataBaseFileName': '$(IntDir)\\vc90b.pdb', source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: pdb_base = '%s.%s.pdb' % (pdb_base, TARGET_TYPE_EXT[target_dict['type']]) source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: pdbpath_cc = pdbpath + '.cc.pdb' source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Dev\elevate\bin\x86\Release\Elevate.pdb source: MayitaV16.exe, 00000000.00000003.1916544111.0000000002B34000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: pdb = self.GetPDBName(config, expand_special, output_name + '.pdb') source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: pdbpath_c = pdbpath + '.c.pdb' source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: # the .pdb by the precompiled header step for .cc and the compilation of source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdb source: MayitaV16.exe, 00000000.00000003.1858941135.00000000051E5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: - Use '<(PRODUCT_DIR)/<(product_name).(exe|dll).pdb' if 'product_name' is source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 'ProgramDatabaseFile': 'Flob.pdb', source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: - Use '<(PRODUCT_DIR)/<(target_name).(exe|dll).pdb'. source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: config_name, self.ExpandSpecial, output + '.pdb') source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\ffmpeg.dll.pdb source: MayitaV16.exe, 00000000.00000003.1860288601.00000000051EC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D3DCompiler_47.pdbGCTL source: MayitaV16.exe, 00000000.00000003.1858941135.00000000051E5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\electron.exe.pdb source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: 'ProgramDataBaseFileName': '$(IntDir)vc90b.pdb', source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vk_swiftshader.dll.pdb source: MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1911988645.00000000051EC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\libGLESv2.dll.pdb source: MayitaV16.exe, 00000000.00000003.1778684027.0000000006930000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: config_name, self.ExpandSpecial, output + '.pdb') source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: '$(IntDir)$(ProjectName)\\vc80.pdb', only_if_unset=True) source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: # See comment at cc_command for why there's two .pdb files. source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: MayitaV16.exe, 00000000.00000003.1856211062.0000000005BE0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1854051189.0000000005490000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1853858810.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1912128736.0000000002B34000.00000004.00000020.00020000.00000000.sdmp
Source: ffmpeg.dll.0.drStatic PE information: section name: .00cfg
Source: ffmpeg.dll.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll.0.drStatic PE information: section name: .00cfg
Source: libEGL.dll.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll.0.drStatic PE information: section name: .retplne
Source: libEGL.dll.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.0.drStatic PE information: section name: .00cfg
Source: libGLESv2.dll.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.0.drStatic PE information: section name: _RDATA
Source: MayitaV16.exe.0.drStatic PE information: section name: .00cfg
Source: MayitaV16.exe.0.drStatic PE information: section name: .gxfg
Source: MayitaV16.exe.0.drStatic PE information: section name: .retplne
Source: MayitaV16.exe.0.drStatic PE information: section name: .rodata
Source: MayitaV16.exe.0.drStatic PE information: section name: CPADinfo
Source: MayitaV16.exe.0.drStatic PE information: section name: LZMADEC
Source: MayitaV16.exe.0.drStatic PE information: section name: _RDATA
Source: MayitaV16.exe.0.drStatic PE information: section name: malloc_h
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .00cfg
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.0.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.0.drStatic PE information: section name: .00cfg
Source: vulkan-1.dll.0.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.0.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.0.drStatic PE information: section name: _RDATA
Source: ffmpeg.dll0.0.drStatic PE information: section name: .00cfg
Source: ffmpeg.dll0.0.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll0.0.drStatic PE information: section name: .retplne
Source: ffmpeg.dll0.0.drStatic PE information: section name: _RDATA
Source: libEGL.dll0.0.drStatic PE information: section name: .00cfg
Source: libEGL.dll0.0.drStatic PE information: section name: .gxfg
Source: libEGL.dll0.0.drStatic PE information: section name: .retplne
Source: libEGL.dll0.0.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll0.0.drStatic PE information: section name: .00cfg
Source: libGLESv2.dll0.0.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll0.0.drStatic PE information: section name: .retplne
Source: libGLESv2.dll0.0.drStatic PE information: section name: _RDATA
Source: MayitaV16.exe0.0.drStatic PE information: section name: .00cfg
Source: MayitaV16.exe0.0.drStatic PE information: section name: .gxfg
Source: MayitaV16.exe0.0.drStatic PE information: section name: .retplne
Source: MayitaV16.exe0.0.drStatic PE information: section name: .rodata
Source: MayitaV16.exe0.0.drStatic PE information: section name: CPADinfo
Source: MayitaV16.exe0.0.drStatic PE information: section name: LZMADEC
Source: MayitaV16.exe0.0.drStatic PE information: section name: _RDATA
Source: MayitaV16.exe0.0.drStatic PE information: section name: malloc_h
Source: 28b06dd0-38bd-4037-96fc-06ceb5da9870.tmp.node.4.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\28b06dd0-38bd-4037-96fc-06ceb5da9870.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Programs\unrealgame\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Programs\unrealgame\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\ffmpeg.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\a6581550-1096-4c7c-b670-a23929eacb81.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\MayitaV16.exeJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Programs\unrealgame\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\28b06dd0-38bd-4037-96fc-06ceb5da9870.tmp.nodeJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\a6581550-1096-4c7c-b670-a23929eacb81.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Local\Programs\unrealgame\LICENSE.electron.txtJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MayitaV16.lnkJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\nsis7z.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\28b06dd0-38bd-4037-96fc-06ceb5da9870.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\SpiderBanner.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\a6581550-1096-4c7c-b670-a23929eacb81.tmp.nodeJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\resources\elevate.exeJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\StdUtils.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\unrealgame\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\MayitaV16.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\MayitaV16.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile opened: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile opened: C:\Users\user\AppData\Local\Programs\unrealgameJump to behavior
Source: C:\Users\user\Desktop\MayitaV16.exeFile opened: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: MayitaV16.exe, 00000000.00000003.1778684027.0000000006930000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware
Source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ADD tools/docker/architecture/linux-arm64/local/qemu-aarch64-static /usr/bin/qemu-aarch64-static
Source: MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: cp -a "/usr/bin/qemu-${arch}-static" "${this_dir}/local"
Source: MayitaV16.exe, 00000000.00000003.1778684027.0000000006930000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: IIAMDARMAppleBroadcomGoogleIntelMesaMicrosoftNVIDIAImagination TechnologiesQualcommSamsung Electronics Co., Ltd.VivanteVMwareVirtIOTestX
Source: MayitaV16.exe, 00000000.00000003.1860288601.00000000051EC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmncVMware Screen Codec / VMware Videovp5On2 VP5vp6On2 VP6vp6fOn2 VP6 (Flash version)targaTruevision Targa imageimage/x-targaimage/x-tga
Source: MayitaV16.exe, 00000000.00000003.1778684027.0000000006930000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: (IsLinux() && isVMWare) || (IsAndroid() && isNvidia) || (IsAndroid() && GetAndroidSdkLevel() < 27 && IsAdreno5xxOrOlder(functions)) || (IsAndroid() && IsMaliT8xxOrOlder(functions)) || (IsAndroid() && IsMaliG31OrOlder(functions))
Source: MayitaV16.exe, 00000000.00000003.1860288601.00000000051EC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Screen Codec / VMware Video
Source: C:\Users\user\Desktop\MayitaV16.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe "C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe "C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2348 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "tasklist"Jump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuidJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM chrome.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM chrome.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM chrome.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM javaw.exe /F
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Steam.exe /F
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM EpicGamesLauncher.exe /F
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM chrome.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM chrome.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /T /IM chrome.exe
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM javaw.exe /F
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /IM Steam.exe /F
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe "c:\users\user\appdata\local\programs\unrealgame\mayitav16.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1852 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe "c:\users\user\appdata\local\programs\unrealgame\mayitav16.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --mojo-platform-channel-handle=2348 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe "c:\users\user\appdata\local\programs\unrealgame\mayitav16.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaabgaaaaaaaaagaaaaaaaaaaiaaaaaaaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1852 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe "c:\users\user\appdata\local\programs\unrealgame\mayitav16.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\unrealgame" --mojo-platform-channel-handle=2348 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Programs\unrealgame VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Programs\unrealgame\resources VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Programs\unrealgame\resources\app.asar VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Temp\mnjk9j2skp9o VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Temp\mnjk9j2skp9o\Autofill VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Temp\mnjk9j2skp9o\Cookies VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Temp\mnjk9j2skp9o\Autofill VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Temp\mnjk9j2skp9o\Cookies VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Temp\mnjk9j2skp9o\Cookies VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Temp\mnjk9j2skp9o\Passwords VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Temp\mnjk9j2skp9o\Passwords VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Program Files\Google\Chrome\Application\chrome.exe VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\First Run VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Temp\chrome_default_cookies.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Temp\edge_default_cookies.txt VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Temp\passwords_36.db VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\AppData\Roaming\All_Wallets.zip VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\Downloads VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldbJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.logJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local Storage\leveldbJump to behavior
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior

Remote Access Functionality

barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
Windows Management Instrumentation		1
Windows Service		1
Windows Service		11
Masquerading		1
OS Credential Dumping		11
Security Software Discovery		Remote Services11
Input Capture		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		1
Registry Run Keys / Startup Folder		11
Process Injection		1
Disable or Modify Tools		11
Input Capture		1
Virtualization/Sandbox Evasion		Remote Desktop Protocol1
Archive Collected Data		1
Remote Access Software		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
DLL Side-Loading		1
Registry Run Keys / Startup Folder		1
Virtualization/Sandbox Evasion		Security Account Manager2
Process Discovery		SMB/Windows Admin Shares1
Data from Local System		1
Ingress Tool Transfer		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
DLL Side-Loading		11
Process Injection		NTDS1
Remote System Discovery		Distributed Component Object ModelInput Capture3
Non-Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
Extra Window Memory Injection		1
DLL Side-Loading		LSA Secrets2
File and Directory Discovery		SSHKeylogging4
Application Layer Protocol		Scheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Extra Window Memory Injection		Cached Domain Credentials33
System Information Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1560584 Sample: MayitaV16.exe Startdate: 22/11/2024 Architecture: WINDOWS Score: 56 57 hexon.fun 2->57 59 api.gofile.io 2->59 7 MayitaV16.exe 17 2->7         started        12 MayitaV16.exe 12 195 2->12         started        process3 dnsIp4 61 hexon.fun 172.67.169.156, 443, 49739, 49740 CLOUDFLARENETUS United States 7->61 63 api.gofile.io 45.112.123.126, 443, 49743, 49768 AMAZON-02US Singapore 7->63 65 127.0.0.1 unknown unknown 7->65 39 a6581550-1096-4c7c...3929eacb81.tmp.node, PE32+ 7->39 dropped 41 28b06dd0-38bd-4037...ceb5da9870.tmp.node, PE32+ 7->41 dropped 71 Attempt to bypass Chrome Application-Bound Encryption 7->71 73 Tries to harvest and steal browser information (history, passwords, etc) 7->73 14 msedge.exe 7->14         started        17 chrome.exe 7->17         started        20 MayitaV16.exe 1 7->20         started        22 12 other processes 7->22 43 C:\Users\user\AppData\Local\...\MayitaV16.exe, PE32+ 12->43 dropped 45 C:\Users\user\AppData\Local\...\nsis7z.dll, PE32 12->45 dropped 47 C:\Users\user\AppData\Local\...\System.dll, PE32 12->47 dropped 49 14 other files (none is malicious) 12->49 dropped 75 Drops large PE files 12->75 file5 signatures6 process7 dnsIp8 51 C:\Users\user\AppData\Local\...\Login Data, SQLite 14->51 dropped 24 msedge.exe 14->24         started        27 msedge.exe 14->27         started        53 239.255.255.250 unknown Reserved 17->53 29 chrome.exe 17->29         started        55 chrome.cloudflare-dns.com 162.159.61.3, 443, 49754, 49755 CLOUDFLARENETUS United States 20->55 31 WMIC.exe 1 22->31         started        33 conhost.exe 22->33         started        35 conhost.exe 22->35         started        37 19 other processes 22->37 file9 process10 dnsIp11 67 ntp.msn.com 24->67 69 www.google.com 142.250.181.100, 443, 49748, 49749 GOOGLEUS United States 29->69

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe8%ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\unrealgame\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\28b06dd0-38bd-4037-96fc-06ceb5da9870.tmp.node0%ReversingLabs
C:\Users\user\AppData\Local\Temp\a6581550-1096-4c7c-b670-a23929eacb81.tmp.node0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\MayitaV16.exe8%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\ffmpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\resources\elevate.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse79D5.tmp\SpiderBanner.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse79D5.tmp\StdUtils.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse79D5.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nse79D5.tmp\nsis7z.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.cs.ru.nl/~sjakie/0%Avira URL Cloudsafe
http://cr.yp.to/djb.html0%Avira URL Cloudsafe
http://hyperelliptic.org/tanja0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
chrome.cloudflare-dns.com
162.159.61.3
truefalse
    		high
    hexon.fun
    		172.67.169.156
    		truefalse
      		unknown
      www.google.com
      		142.250.181.100
      		truefalse
        		high
        api.gofile.io
        		45.112.123.126
        		truefalse
          		high
          ntp.msn.com
          		unknown
          		unknownfalse
            		high

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://bugzilla.mozilla.org/show_bug.cgi?id=310299MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              https://url.spec.whatwg.org/#concept-url-originMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://tools.ietf.org/html/rfc6455#section-1.3MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  https://github.com/browserify/node-utilMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    https://github.com/isaacs/node-glob/issues/205MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://support.google.com/chrome/answer/6098869MayitaV16.exe, 00000000.00000003.1912812737.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913719069.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1915338616.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914021068.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914360554.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914233029.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914678988.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913261780.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913814892.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913341916.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913604749.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913073283.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914504169.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1914124365.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913892148.0000000002B34000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1913406165.0000000002B34000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://www.bluetooth.com/specifications/gatt/servicesMayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          https://github.com/mathiasbynens/emoji-regex.gitMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://github.com/WebBluetoothCG/web-bluetooth/blob/main/implementation-status.mdMayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              https://github.com/nodejs/node/pull/35941MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpfalse
                                		high
                                https://console.spec.whatwg.org/#tableMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  https://github.com/nodejs/string_decoderMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		high
                                    https://goo.gl/7K7WLuTheMayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		high
                                      https://encoding.spec.whatwg.org/#textencoderMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		high
                                        https://goo.gl/7K7WLuMayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          https://www.patreon.com/ferossMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		high
                                            https://github.com/tc39/proposal-weakrefsMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://goo.gl/t5IS6M).MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/google/caja/blob/HEAD/src/com/google/caja/ses/repairES5.jsMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://tc39.github.io/ecma262/#sec-%iteratorprototype%-objectMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://url.spec.whatwg.org/#concept-urlencoded-serializerMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://semver.org/MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3FMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://nodejs.org/api/fs.htmlMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://chromium.googlesource.com/chromium/src/MayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://github.com/nodejs/node/pull/21313MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://w3c.github.io/manifest/#installability-signalsMayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://www.midnight-commander.org/browser/lib/tty/key.cMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://nodejs.org/MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://tools.ietf.org/html/rfc7540#section-8.1.2.5MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://exslt.org/commonMayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://github.com/tensorflow/modelsMayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.squid-cache.org/Doc/config/half_closed_clients/MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://github.com/KhronosGroup/SPIRV-Headers.gitMayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://tc39.es/ecma262/#sec-timeclipMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://127.0.0.1MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://github.com/nodejs/node/pull/33661MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://www.nongnu.org/freebangfont/downloads.html#muktiMayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWithMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://narwhaljs.org)MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://github.com/tensorflow/tflite-supportMayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://github.com/WICG/scheduling-apisMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://sqlite.org/MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://localhosthttp://127.0.0.1object-srcMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://code.google.com/p/chromium/issues/detail?id=25916MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://moztw.org/docs/big5/MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://fetch.spec.whatwg.org/#fetch-timing-infoMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://www.ogcio.gov.hk/tc/business/tech_promotion/ccli/terms/doc/hkscs-2008-big5-iso.txtMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://webassembly.github.io/spec/web-apiMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://github.com/nodejs/node/pull/12607MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://www.ecma-international.org/ecma-262/#sec-line-terminatorsMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://www.cs.ru.nl/~sjakie/MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  • Avira URL Cloud: safe
                                                                                                                  		unknown
                                                                                                                  https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txtMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://ljharb.codesMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://gitter.im/form-data/form-data)MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://github.com/npm/node-tar/issues/183MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://www.npmjs.com/package/form-data)MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://github.com/facebook/react-native/pull/1632MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://gitlab.freedesktop.org/xdg/xdgmimeMayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://www.unicode.org/copyright.htmlMayitaV16.exe, 00000000.00000003.1755606463.0000000005DE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://beacons.gcp.gvt2.com/domainreliability/uploadMayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://github.com/blueimp/JavaScript-MD5MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://opensource.org/licenses/MITMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://github.com/RyanZim/universalify.gitMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://heycam.github.io/webidl/#es-iterable-entriesMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://github.com/wasdk/wasmparserMayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://heycam.github.io/webidl/#es-interfacesMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaqueMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://github.com/nodejs/node/issuesMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://encoding.spec.whatwg.org/#encode-and-enqueue-a-chunkMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://tc39.github.io/ecma262/#sec-object.prototype.tostringMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://url.spec.whatwg.org/#urlsearchparamsMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://github.com/sponsors/isaacsMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://infra.spec.whatwg.org/#ascii-whitespaceMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://hyperelliptic.org/tanjaMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                              		unknown
                                                                                                                                                              http://pajhome.org.uk/crypt/md5MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://dejavu-fonts.github.io/Download.htmlMayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://heycam.github.io/webidl/#ReplaceableMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://www.rfc-editor.org/rfc/rfc9110#section-5.2MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://stackoverflow.com/a/16459606/376773MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://github.com/nodejs/node/pull/30380#issuecomment-552948364MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://pagure.io/lohitMayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://html.spec.whatwg.org/multipage/timers-and-user-prompts.html#dom-setintervalMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://juliangruber.comMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://github.com/sponsors/ferossMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://heycam.github.io/webidl/#dfn-class-stringMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://heycam.github.io/webidl/#dfn-iterator-prototype-objectMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://datatracker.ietf.org/doc/html/rfc7238MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        http://cr.yp.to/djb.htmlMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        https://android.com/payMayitaV16.exe, 00000000.00000003.1856498094.0000000006930000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://github.com/nodejs/node/pull/38614)MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://github.com/nodejs/node/issues/10673MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://bugzilla.mozilla.org/show_bug.cgi?id=695438).MayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://github.com/nodejs/node/pull/32887MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1770644615.0000000005131000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  https://github.com/web-animations/web-animations-jsMayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    http://labs.creativecommons.org/licenses/zero-waive/1.0/us/legalcode&gt;MayitaV16.exe, 00000000.00000003.1866290249.00000000051E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      https://github.com/npm/fs-minipass#readmeMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		high
                                                                                                                                                                                                        https://tc39.es/ecma262/#sec-%typedarray%-intrinsic-objectMayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          		high
                                                                                                                                                                                                          https://github.com/nodejs/node/issues/19009MayitaV16.exe, 00000000.00000003.1857026590.00000000073B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                            		high
                                                                                                                                                                                                            https://sindresorhus.comMayitaV16.exe, 00000000.00000003.1771018100.00000000067F0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1771274830.0000000006BF0000.00000004.00001000.00020000.00000000.sdmp, MayitaV16.exe, 00000000.00000003.1916251294.00000000051E2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              		high

                                                                                                                                                                                                              World Map of Contacted IPs

                                                                                                                                                                                                              • No. of IPs < 25%
                                                                                                                                                                                                              • 25% < No. of IPs < 50%
                                                                                                                                                                                                              • 50% < No. of IPs < 75%
                                                                                                                                                                                                              • 75% < No. of IPs

                                                                                                                                                                                                              Public IPs

                                                                                                                                                                                                              IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                              142.250.181.100
                                                                                                                                                                                                              		www.google.comUnited States
                                                                                                                                                                                                              		15169GOOGLEUSfalse
                                                                                                                                                                                                              172.67.169.156
                                                                                                                                                                                                              		hexon.funUnited States
                                                                                                                                                                                                              		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                              162.159.61.3
                                                                                                                                                                                                              		chrome.cloudflare-dns.comUnited States
                                                                                                                                                                                                              		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                              239.255.255.250
                                                                                                                                                                                                              		unknownReserved
                                                                                                                                                                                                              		unknownunknownfalse
                                                                                                                                                                                                              45.112.123.126
                                                                                                                                                                                                              		api.gofile.ioSingapore
                                                                                                                                                                                                              		16509AMAZON-02USfalse

                                                                                                                                                                                                              Private

                                                                                                                                                                                                              IP
                                                                                                                                                                                                              127.0.0.1

                                                                                                                                                                                                              General Information

                                                                                                                                                                                                              Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                              Analysis ID:1560584
                                                                                                                                                                                                              Start date and time:2024-11-22 00:35:15 +01:00
                                                                                                                                                                                                              Joe Sandbox product:CloudBasic
                                                                                                                                                                                                              Overall analysis duration:0h 8m 5s
                                                                                                                                                                                                              Hypervisor based Inspection enabled:false
                                                                                                                                                                                                              Report type:full
                                                                                                                                                                                                              Cookbook file name:default.jbs
                                                                                                                                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                              Number of analysed new started processes analysed:50
                                                                                                                                                                                                              Number of new started drivers analysed:0
                                                                                                                                                                                                              Number of existing processes analysed:0
                                                                                                                                                                                                              Number of existing drivers analysed:0
                                                                                                                                                                                                              Number of injected processes analysed:0
                                                                                                                                                                                                              Technologies:
                                                                                                                                                                                                              • EGA enabled
                                                                                                                                                                                                              • AMSI enabled
                                                                                                                                                                                                              Analysis Mode:default
                                                                                                                                                                                                              Analysis stop reason:Timeout
                                                                                                                                                                                                              Sample name:MayitaV16.exe
                                                                                                                                                                                                              Detection:MAL
                                                                                                                                                                                                              Classification:mal56.troj.spyw.winEXE@93/213@8/6
                                                                                                                                                                                                              Cookbook Comments:
                                                                                                                                                                                                              • Found application associated with file extension: .exe

                                                                                                                                                                                                              Warnings

                                                                                                                                                                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
                                                                                                                                                                                                              • Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.19.238, 74.125.205.84, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 13.107.6.158, 13.87.96.169, 142.250.65.163, 142.250.80.35, 142.251.32.99
                                                                                                                                                                                                              • Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, clientservices.googleapis.com, clients2.google.com, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, prod-agic-us-1.uksouth.cloudapp.azure.com, otelrules.azureedge.net, a-0003.a-msedge.net, ctldl.windowsupdate.com, www-msn-com.a-0003.a-msedge.net, b-0005.b-msedge.net, prod-atm-wds-edge.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, l-0007.config.skype.com, business.bing.com, clients.l.google.com, dual-a-0036.a-msedge.net
                                                                                                                                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                              • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                              • VT rate limit hit for: MayitaV16.exe

                                                                                                                                                                                                              Simulations

                                                                                                                                                                                                              Behavior and APIs

                                                                                                                                                                                                              TimeTypeDescription
                                                                                                                                                                                                              18:36:21API Interceptor12x Sleep call for process: MayitaV16.exe modified
                                                                                                                                                                                                              18:36:37API Interceptor1x Sleep call for process: WMIC.exe modified

                                                                                                                                                                                                              Joe Sandbox View / Context

                                                                                                                                                                                                              IPs

                                                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                              172.67.169.156https://webhosting.icicidirect.com/TDSCERT/UserResponseClickLogs.jsp?ID=DMAIL_03-JUL-2023_457530_48792&type=GETINSTANTEMICARDNOW&url=https://dalexglobal.com/ahhgdbbed/QuaYHqKjWucBYFI/CI1hColjh4wbAgPrZmwS1dprkh1ofeGet hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                                                                                                                                                                                Secured Doc-[aQb-26731].pdfGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                  Secured Doc-[aAO-49313]-2.pdfGet hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                                                                                                                                                                                    Secured Doc-[TmW-65795].pdfGet hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                                                                                                                                                                                      Secured Doc-[wSP-29072].pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        162.159.61.3file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                                          file.exeGet hashmaliciousAmadey, XWormBrowse
                                                                                                                                                                                                                            FW_ Signature Required For Agreement with ID_41392PJBM8759674.msgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                                                1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                  file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                      S0FTWARE.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                                                        wE1inOhJA5.msiGet hashmaliciousRemcos, RHADAMANTHYSBrowse
                                                                                                                                                                                                                                          test2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            239.255.255.250https://doam29-kk5ug.ondigitalocean.app/Get hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                                                                  file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                    file.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                                                                                                                                                                                                                                      http://amz-account-unlock-dashboard4.duckdns.orgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                        Invoice_Billing_carolinadunesbh.com_6995261057.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                          file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                            file.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                                                                              https://temp.farenheit.net/XMDNvVFp0d0NmOUNSbFJTSVB2QTRuZktxeWdPaG5ReWxrK1NleVgvbGgvakhBRU5TWkZPQW14RDZLMTlST0pJK3Jja1R0bjkyZkxubHc1UXhLdmU5UVNJcVIyU25JdFVIV0hEc3l3R0kvb3VpWWFlWGxvWmJMSDIwaWRkYTV3c2V3ZnpXcVArUkJXbEpTeWU1SCtuRWNpRVI2RFFuNXh1ODEyQUx3WlNCdDB1N3NjcDh2M1p4MU9qSkJ0R2VDV0VDeVJ4THU5bDM5SkkvaGMxc1hEc3pOb0VtcWl0cDUxemRyc1BwMkE9PS0tRklOcExLZUVZVVZGemhWRC0teTZKNGN1UnI2dUIxL3E5Zm91Q2hVZz09?cid=2268024206Get hashmaliciousKnowBe4Browse
                                                                                                                                                                                                                                                                45.112.123.126bZPAo2e2Pv.jarGet hashmaliciousCan StealerBrowse
                                                                                                                                                                                                                                                                  bZPAo2e2Pv.jarGet hashmaliciousCan StealerBrowse
                                                                                                                                                                                                                                                                    iDvmIRCPBw.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                      ZdXUGLQpoL.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        jaPB8q3WL1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                          yx7VCK1nxU.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                            RuntimeusererVers.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                                                                              file.exeGet hashmaliciousCStealerBrowse
                                                                                                                                                                                                                                                                                dens.exeGet hashmaliciousPython Stealer, Exela Stealer, Waltuhium GrabberBrowse
                                                                                                                                                                                                                                                                                  file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse

                                                                                                                                                                                                                                                                                    Domains

                                                                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                                                    chrome.cloudflare-dns.comfile.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, XWormBrowse
                                                                                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                                                                                    1732215862df90b858ebf82740ce134fb5917becbb3385f4dfc36cbe28d6e90709df01f065739.dat-decoded.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                                                                                    S0FTWARE.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                                                                                    wE1inOhJA5.msiGet hashmaliciousRemcos, RHADAMANTHYSBrowse
                                                                                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                                                                                    test2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 162.159.61.3
                                                                                                                                                                                                                                                                                    api.gofile.iobZPAo2e2Pv.jarGet hashmaliciousCan StealerBrowse
                                                                                                                                                                                                                                                                                    • 45.112.123.126
                                                                                                                                                                                                                                                                                    bZPAo2e2Pv.jarGet hashmaliciousCan StealerBrowse
                                                                                                                                                                                                                                                                                    • 45.112.123.126
                                                                                                                                                                                                                                                                                    iDvmIRCPBw.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 45.112.123.126
                                                                                                                                                                                                                                                                                    ZdXUGLQpoL.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 45.112.123.126
                                                                                                                                                                                                                                                                                    jaPB8q3WL1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 45.112.123.126
                                                                                                                                                                                                                                                                                    yx7VCK1nxU.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 45.112.123.126
                                                                                                                                                                                                                                                                                    RuntimeusererVers.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                                                                                    • 45.112.123.126
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousCStealerBrowse
                                                                                                                                                                                                                                                                                    • 45.112.123.126
                                                                                                                                                                                                                                                                                    dens.exeGet hashmaliciousPython Stealer, Exela Stealer, Waltuhium GrabberBrowse
                                                                                                                                                                                                                                                                                    • 45.112.123.126
                                                                                                                                                                                                                                                                                    Creal.exeGet hashmaliciousCreal StealerBrowse
                                                                                                                                                                                                                                                                                    • 45.112.123.126

                                                                                                                                                                                                                                                                                    ASNs

                                                                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                                                    CLOUDFLARENETUShttps://doam29-kk5ug.ondigitalocean.app/Get hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                                                                                                                    • 162.159.140.98
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                                                                    • 104.21.66.38
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                                                    • 172.67.155.248
                                                                                                                                                                                                                                                                                    http://amz-account-unlock-dashboard4.duckdns.orgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 104.18.11.207
                                                                                                                                                                                                                                                                                    Invoice_Billing_carolinadunesbh.com_6995261057.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 104.17.25.14
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                                                    • 104.21.66.38
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, XWormBrowse
                                                                                                                                                                                                                                                                                    • 172.67.75.163
                                                                                                                                                                                                                                                                                    http://t.ly/YSjhIGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 104.17.25.14
                                                                                                                                                                                                                                                                                    https://app.smartsheet.com/b/form/9141bdd4d7da45789170a7064a677627Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                    • 104.18.11.207
                                                                                                                                                                                                                                                                                    CLOUDFLARENETUShttps://doam29-kk5ug.ondigitalocean.app/Get hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                                                                                                                    • 162.159.140.98
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                                                                    • 104.21.66.38
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                                                                                                    • 172.64.41.3
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                                                    • 172.67.155.248
                                                                                                                                                                                                                                                                                    http://amz-account-unlock-dashboard4.duckdns.orgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 104.18.11.207
                                                                                                                                                                                                                                                                                    Invoice_Billing_carolinadunesbh.com_6995261057.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 104.17.25.14
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                                                    • 104.21.66.38
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, XWormBrowse
                                                                                                                                                                                                                                                                                    • 172.67.75.163
                                                                                                                                                                                                                                                                                    http://t.ly/YSjhIGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 104.17.25.14
                                                                                                                                                                                                                                                                                    https://app.smartsheet.com/b/form/9141bdd4d7da45789170a7064a677627Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                                    • 104.18.11.207
                                                                                                                                                                                                                                                                                    AMAZON-02USx86_32.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                                                                                                    • 54.105.14.168
                                                                                                                                                                                                                                                                                    anarchy.arm6.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                                                                    • 34.249.145.219
                                                                                                                                                                                                                                                                                    https://temp.farenheit.net/XMDNvVFp0d0NmOUNSbFJTSVB2QTRuZktxeWdPaG5ReWxrK1NleVgvbGgvakhBRU5TWkZPQW14RDZLMTlST0pJK3Jja1R0bjkyZkxubHc1UXhLdmU5UVNJcVIyU25JdFVIV0hEc3l3R0kvb3VpWWFlWGxvWmJMSDIwaWRkYTV3c2V3ZnpXcVArUkJXbEpTeWU1SCtuRWNpRVI2RFFuNXh1ODEyQUx3WlNCdDB1N3NjcDh2M1p4MU9qSkJ0R2VDV0VDeVJ4THU5bDM5SkkvaGMxc1hEc3pOb0VtcWl0cDUxemRyc1BwMkE9PS0tRklOcExLZUVZVVZGemhWRC0teTZKNGN1UnI2dUIxL3E5Zm91Q2hVZz09?cid=2268024206Get hashmaliciousKnowBe4Browse
                                                                                                                                                                                                                                                                                    • 52.217.192.233
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, XWormBrowse
                                                                                                                                                                                                                                                                                    • 18.238.49.99
                                                                                                                                                                                                                                                                                    http://t.ly/YSjhIGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 13.227.8.58
                                                                                                                                                                                                                                                                                    file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                                                                                                                                                    • 3.168.102.127
                                                                                                                                                                                                                                                                                    tftp.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 54.171.230.55
                                                                                                                                                                                                                                                                                    https://bafkreifkijr4deqnzixvigwgbpmegtl7w7z65bwaf2xegf6wb5oejvy7je.ipfs.flk-ipfs.xyz/#mail@andrejsmanagement.com&c=E,1,7ZfSQ9vAYe7rvB9NwKAqcoBV6_2nCPL09QKb7jG3WYDaiZix9u1hiaulren8GlCVh8tr3ArY61yo0-gZFvLQqJ6pANsbQuIKnEW2EuUntXIIWBvyOuRTAdpQ&typo=1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 108.158.75.9
                                                                                                                                                                                                                                                                                    https://t.apemail.net/c/nqkr6vk3kzmvyhqvdmdrwaabb4caabycb4nqogyhdmkxs5qvdmkqcvagayhveflk-nqdbwfkcivnrkgyvpf3bkgygamaa4bqedmcagbahdmdrwbqcaubqoayfdmdrwby3cupvkw2wlfob4fi3a4nvsqs3lmnrkzcskzbugw2sc5svevs3c5zeiq2winjbo5kcirpfsuseiqlwer2tkzbvefi3aaaq6baaa4ba6gyvl5bugr2ebumbqvsdjzlfcgk3jymfmrcekjbuifi3incueuq3aabaegyvpf3bkg2zijnvwg2zijnvwg2zijnvwg2zijnvwgyvafkambqpkikwuGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    • 54.201.238.29
                                                                                                                                                                                                                                                                                    ULNZPn6D33.exeGet hashmaliciousSliverBrowse
                                                                                                                                                                                                                                                                                    • 18.197.239.5

                                                                                                                                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                                                                                                                                    ⊘No context

                                                                                                                                                                                                                                                                                    Dropped Files

                                                                                                                                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dllXa04iTOvv5.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                        ArenaWarsSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                          ArenaWarsSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                            Launcher 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                              Launcher 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                Xeno Executor Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                  Xeno Executor Setup 1.0.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                    Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\28a0cb84-93f4-4571-805c-0e20b49aaa86.tmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8389
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.788778281165924
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:192:fsNwzCvReiRUoqQXklkt6qRAq1k8SPxVLZ7VTiQ:fsNwevhVzUlC6q3QxVNZTiQ
                                                                                                                                                                                                                                                                                                        MD5:BA12919B8111B85A4A2E6A516E57964D
                                                                                                                                                                                                                                                                                                        SHA1:C7952D637FA2F798DAC93BEFB6F2F02906758939
                                                                                                                                                                                                                                                                                                        SHA-256:B947F687FEEC487BB858F86BEB64677EF1F35529529CE9879EFB71426461042B
                                                                                                                                                                                                                                                                                                        SHA-512:F69B6D73FF75184DB5954B451626A73665F8FB201886737F7A631061EC2452381F146D5A54BC5FB425497F05D9E98E9CEEA4B41CAF4E327FE3D1C24FE8F359F9
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2e9bc0ff-3bcf-4063-b594-69e9c3dcb497.tmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):6820
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.793431352475268
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:96:iaqkHf7Cva+5ih/cI9URLl8RotovMFVvlwh2e4IbONIeTC6XQS0qGqk+Z4uj+rj1:akzCvOeiRUwhW6qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                                                                                                                        MD5:93DD77C3C62262584CF9B02B33411D7D
                                                                                                                                                                                                                                                                                                        SHA1:84E0CF5DE0756B2684DB296C96F40EBB9336C89D
                                                                                                                                                                                                                                                                                                        SHA-256:AAFD7E769D2B71EE2A5F3142CC8499570C78C32BFAD9513F1F32A12F0BA66A1A
                                                                                                                                                                                                                                                                                                        SHA-512:5DE9641141E2C900EDBDA545FC1281C8B90028A484853E37697EABE57FA50EEF1A7E4BC2EE791C2BFD87151E84F3B9F5B1D79ABE3B4018F9414A87EC04A963B5
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA7nGpp1gOERJDFeCbMTomaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADByQ180GX5OjXu5Dvv+a5cTd+8CRY5HwgLoQtRHUrZyQAAAAA

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673FC410-1E04.pma

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):4194304
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.24944954854194556
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:1536:GyaJH2McPQ0I1kMvM5SRGJBdNboPDyy2iEv6OcRtj:GyuWxPQ0I1HvM5bJBdNcP/uv6OcRtj
                                                                                                                                                                                                                                                                                                        MD5:13DEB7917286233700994021CB77EE44
                                                                                                                                                                                                                                                                                                        SHA1:F28D3E63AB45795167F1ECFA974822A6EB10D482
                                                                                                                                                                                                                                                                                                        SHA-256:24AC4457B587E65A19FEEC3DB9BFF5F5049429F4F279C52F45B5B4772EA37E26
                                                                                                                                                                                                                                                                                                        SHA-512:443994BAF4588E41DDD91644E12F436A07BBF2545E0A2F91F52A3784A5D5190895355E0008D8BDB6BD4EBB472A9909DCA7DE01A5486F32310F8B76ABE8D806AF
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:...@..@...@.....C.].....@................S...S..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....y.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".ntdhci20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./........................<.w..U'D.I..G...W6.....>.........."....."...2...".*.:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....trig

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):280
                                                                                                                                                                                                                                                                                                        Entropy (8bit):1.7848956527006603
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:FiWWltl/9U1i2RRIxINXj1C:o1/R2Yq2
                                                                                                                                                                                                                                                                                                        MD5:C48FB0C839F52094E5B7ED752859BB4F
                                                                                                                                                                                                                                                                                                        SHA1:D7863FA68E45C3432E10236A977708A44E300FAB
                                                                                                                                                                                                                                                                                                        SHA-256:EFFCFFAA8C3AE23BC6BBBF20BEFC538BCE1C6641096837F63E94124D5794FB1B
                                                                                                                                                                                                                                                                                                        SHA-512:16AB8BA83EF97293FA75C34EC1C40CB53408159B201A57B2FA2185EE66B21F9708CFA289B9CF3413253BAB4AE7E9700C3469CDCBA03672992077BA8BB22EF641
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:sdPC......................5.y&.K.?....................................................................................................................................................................................................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsFl:/F
                                                                                                                                                                                                                                                                                                        MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                                                                        SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                                                                        SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                                                                        SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):270336
                                                                                                                                                                                                                                                                                                        Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                                                                                                                                        MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                                                                        SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                                                                        SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                                                                        SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                                                                                                                        MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                                                                        SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                                                                        SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                                                                        SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                                                                                                                        MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                                                                        SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                                                                        SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                                                                        SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):262512
                                                                                                                                                                                                                                                                                                        Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:LsNl0jKX:Ls30jK
                                                                                                                                                                                                                                                                                                        MD5:F706C193A5E6C56F22FF7DDBB2111089
                                                                                                                                                                                                                                                                                                        SHA1:C69FD0F1C62853CC7287DF7B0E62BB2D3B7EEA82
                                                                                                                                                                                                                                                                                                        SHA-256:4FBD8D96C02F891A99FA6F7CC737CCE95152C3BF58976F9B711F916C68368D88
                                                                                                                                                                                                                                                                                                        SHA-512:0F53912D173D73AC682F54A3C67E16A6DC089F8A456F5CC406EA7ECC6E3B2E978AB734E9D104A328E228D7229C09F2644A79CBFAB72A5929200041997B3A1267
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):16
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                                                                                        MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                                        SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                                        SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                                        SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):33
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.5394429593752084
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:iWstvhYNrkUn:iptAd
                                                                                                                                                                                                                                                                                                        MD5:F27314DD366903BBC6141EAE524B0FDE
                                                                                                                                                                                                                                                                                                        SHA1:4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
                                                                                                                                                                                                                                                                                                        SHA-256:68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
                                                                                                                                                                                                                                                                                                        SHA-512:07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:...m.................DB_VERSION.1

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):16
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                                                                                        MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                                        SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                                        SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                                        SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):305
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.208780018930034
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEz4saRq1wkn23oH+TcwtnG2tbB2KLlVEzTo+q2Pwkn23oH+TcwtnG2tMsIFUv:k6bfYebn9VFLs1vYfYebn9GFUv
                                                                                                                                                                                                                                                                                                        MD5:C72588F26C7F4A99EEAC76E2781A5CDC
                                                                                                                                                                                                                                                                                                        SHA1:3B4FF87D151579F35B98B7918389D3ADDE4F32F7
                                                                                                                                                                                                                                                                                                        SHA-256:FB22196B875FF240CCD0C43B8D2A667E55173FA85A602D191126C6F0249F212E
                                                                                                                                                                                                                                                                                                        SHA-512:E13DBE8453562D0806BC62ED5304DD736F89B959E756173EE6007ED96C2A9D2E1074D456631C5C24687F58FB145A2F2FB461B0679C903FBFFFAD6DE6168BB022
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:48.983 1c18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/11/21-18:36:49.048 1c18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):41
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                                                                                                                        MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                                        SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                                        SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                                        SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 6, cookie 0x7, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):24576
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.4778112365987579
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:24:TLiIBdC30OIcqIn2D5UFlA2cqlejcI5fc:TOI+LajUnA5cEc
                                                                                                                                                                                                                                                                                                        MD5:455A0404F6647AC6A6F3840F5A0656A4
                                                                                                                                                                                                                                                                                                        SHA1:895BF976E8EA0EF6E542C72A5A1332280FDC291C
                                                                                                                                                                                                                                                                                                        SHA-256:1EC34FDF30C7662E0F5AEB81E45EF262AC11560740A80AEBAE6FD6323C5647D4
                                                                                                                                                                                                                                                                                                        SHA-512:2877AD0C181424D98C22316A5B609565593CF278189AB25508F57101C3EFC7CCBF48CDA4243F008ECC7B6F8CE07BBD7C21BBE65720BADBD4442D25229C951FDB
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j...i...d..d.....t....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db-journal

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:modified
                                                                                                                                                                                                                                                                                                        Size (bytes):4616
                                                                                                                                                                                                                                                                                                        Entropy (8bit):1.7420461243455454
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12:GLqLitm1DfgazCjA3ApAxnS0OIgDqIjD2DXyxOUFaimydG2cjul+X:yqLiIBdC30OIcqIn2D5UFlA2cql+X
                                                                                                                                                                                                                                                                                                        MD5:BA211DEE7061A5DA1D2F3FB7960D0E58
                                                                                                                                                                                                                                                                                                        SHA1:FAB0FB47B9DC021E64EDF88D114732E40C430C6E
                                                                                                                                                                                                                                                                                                        SHA-256:A28547CFD88D0991610F73FD06721A081BB85F1D834AB50825E24E5DBCF2BA06
                                                                                                                                                                                                                                                                                                        SHA-512:90A17A05E2F1D18C05AE1299AF464C107FC27D579B97C8A0CABF0E9B34D24872B6AB7E1E8A54EA572D7D393C065AB127C7FE306CEAE3EAE4087D5BFA022C9F7F
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............Neh.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j...i...d..d.....t................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):16
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                                                                                        MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                                        SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                                        SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                                        SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):171
                                                                                                                                                                                                                                                                                                        Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
                                                                                                                                                                                                                                                                                                        MD5:E952942B492DB39A75DD2669B98EBE74
                                                                                                                                                                                                                                                                                                        SHA1:F6C4DEF325DCA0DFEC01759D7D8610837A370176
                                                                                                                                                                                                                                                                                                        SHA-256:14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
                                                                                                                                                                                                                                                                                                        SHA-512:9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):16
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                                                                                        MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                                        SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                                        SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                                        SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):281
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.164428961117918
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEz4j5D1wkn23oH+Tcwt8aVdg2KLlVEzTgUi+q2Pwkn23oH+Tcwt8aPrqIFUv:kcyfYeb0LsHi+vYfYebL3FUv
                                                                                                                                                                                                                                                                                                        MD5:060FED0C32327D0B3FEF4CD7025C96BD
                                                                                                                                                                                                                                                                                                        SHA1:E6554C83C7F8DC4D61838F687F5D994B61DCADE1
                                                                                                                                                                                                                                                                                                        SHA-256:065FFAF848FE8FEA69AFBDC8CA646EF1AE89045BBC847AEA51AF5FBE2D723064
                                                                                                                                                                                                                                                                                                        SHA-512:5389FEB83A6AB0456E086B6BD9A596E1CD8DD973BB11838A1D17E6DFD6F6E514763999AC65BB4C1DA00294E8C08C72CA331EF542DC478D6AF458166631E174D5
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:48.991 1fec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/11/21-18:36:49.189 1fec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):41
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                                                                                                                        MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                                        SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                                        SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                                        SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):16
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                                                                                        MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                                        SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                                        SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                                        SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):171
                                                                                                                                                                                                                                                                                                        Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
                                                                                                                                                                                                                                                                                                        MD5:E952942B492DB39A75DD2669B98EBE74
                                                                                                                                                                                                                                                                                                        SHA1:F6C4DEF325DCA0DFEC01759D7D8610837A370176
                                                                                                                                                                                                                                                                                                        SHA-256:14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
                                                                                                                                                                                                                                                                                                        SHA-512:9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):16
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                                                                                        MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                                        SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                                        SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                                        SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):285
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.143630705162594
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEzTgcbD1wkn23oH+Tcwt86FB2KLlVEzTTO+q2Pwkn23oH+Tcwt865IFUv:khbyfYeb/FFLsLO+vYfYeb/WFUv
                                                                                                                                                                                                                                                                                                        MD5:2BEBC80BBEF669DB425556DD19CD314C
                                                                                                                                                                                                                                                                                                        SHA1:00B20487EBD4CD7F63A6941D471B5F7838BEDD53
                                                                                                                                                                                                                                                                                                        SHA-256:1D1B8FFB5AA8B66A416151DC6D6E2BA13A3B4A3942C1EAD13780C25839E75A17
                                                                                                                                                                                                                                                                                                        SHA-512:47D1C7D9A3B10A009A7A97C6694B7CB0B1D3081CBFAEEDCA07087868439CD2874B87658505B58C42F4D993948CB54297AFE7D34DCCFE440E92B00C1CC3E10FE4
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.191 1fec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/11/21-18:36:49.440 1fec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):41
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                                                                                                                        MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                                        SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                                        SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                                        SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):1083
                                                                                                                                                                                                                                                                                                        Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
                                                                                                                                                                                                                                                                                                        MD5:F5DB9E03121BAEFA935729AECA8F9B25
                                                                                                                                                                                                                                                                                                        SHA1:566AB4BEA20FCA1E5DC02458820EDEAB0D089FCE
                                                                                                                                                                                                                                                                                                        SHA-256:6AF84BCBACC6188E9DC569332B289BA93FE5495124E53D7C2213F43CE23C51D6
                                                                                                                                                                                                                                                                                                        SHA-512:A3B7DC9910A812BE90F789C257FDAAA35D04DD418FDB9C9FAD8E4E28C5D311DAC744CD64D16E9681554213FFD0CF9815EC24CF7E0BE4D78CE93C9AF27F6CFB20
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):322
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.205437441926207
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEzTmnG3+q2Pwkn23oH+Tcwt8NIFUt8YEzTmILXWZmw+YEzTmILiVkwOwkn23oHt:kOni+vYfYebpFUt8/OILXW/+/OILiV5Y
                                                                                                                                                                                                                                                                                                        MD5:45CD2BECE5871B967BAC831A615706F1
                                                                                                                                                                                                                                                                                                        SHA1:FB4DEBD9044E8D2F8EDE3E96337A9C3FE89728AC
                                                                                                                                                                                                                                                                                                        SHA-256:1C4B3D3D20BB898E8E1E0AE410CC04416D0AAC83203FED2AF941B703B62E4490
                                                                                                                                                                                                                                                                                                        SHA-512:9C01DF6039D2748EE275D5927D7F40F7D1A7E0C5461DE060E3E8E4A512A9C126AB92AD2BB2C6A98B083936F24D670C02AC242CAE03478B82699482ACA64D0CDC
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.706 1fec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/21-18:36:49.707 1fec Recovering log #3.2024/11/21-18:36:49.707 1fec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):322
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.205437441926207
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEzTmnG3+q2Pwkn23oH+Tcwt8NIFUt8YEzTmILXWZmw+YEzTmILiVkwOwkn23oHt:kOni+vYfYebpFUt8/OILXW/+/OILiV5Y
                                                                                                                                                                                                                                                                                                        MD5:45CD2BECE5871B967BAC831A615706F1
                                                                                                                                                                                                                                                                                                        SHA1:FB4DEBD9044E8D2F8EDE3E96337A9C3FE89728AC
                                                                                                                                                                                                                                                                                                        SHA-256:1C4B3D3D20BB898E8E1E0AE410CC04416D0AAC83203FED2AF941B703B62E4490
                                                                                                                                                                                                                                                                                                        SHA-512:9C01DF6039D2748EE275D5927D7F40F7D1A7E0C5461DE060E3E8E4A512A9C126AB92AD2BB2C6A98B083936F24D670C02AC242CAE03478B82699482ACA64D0CDC
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.706 1fec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/21-18:36:49.707 1fec Recovering log #3.2024/11/21-18:36:49.707 1fec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):159744
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.5241404324800358
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
                                                                                                                                                                                                                                                                                                        MD5:241322143A01979D346689D9448AC8C0
                                                                                                                                                                                                                                                                                                        SHA1:DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
                                                                                                                                                                                                                                                                                                        SHA-256:65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
                                                                                                                                                                                                                                                                                                        SHA-512:9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):28672
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.33890226319329847
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
                                                                                                                                                                                                                                                                                                        MD5:971F4C153D386AC7ED39363C31E854FC
                                                                                                                                                                                                                                                                                                        SHA1:339841CA0088C9EABDE4AACC8567D2289CCB9544
                                                                                                                                                                                                                                                                                                        SHA-256:B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
                                                                                                                                                                                                                                                                                                        SHA-512:1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):406
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.277348109163873
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12:kT4vYfYeb8rcHEZrELFUt8//DNJ/+//DND5JfYeb8rcHEZrEZSJ:k+YfYeb8nZrExg8/rUrXJfYeb8nZrEZe
                                                                                                                                                                                                                                                                                                        MD5:3AC6FE6390BD3B869D58AFC2FCBDFF74
                                                                                                                                                                                                                                                                                                        SHA1:03583FCB0B5CD2785EC73BAF3AFE9CFBD22B83E6
                                                                                                                                                                                                                                                                                                        SHA-256:A019F9433F4B510FA5CEF152FDA65FA383197FE6D08DE3D85994D04F384F366B
                                                                                                                                                                                                                                                                                                        SHA-512:D0304C2E444AAE2548B56FAF45B1CF7C21F3DFAA77303F7960150820A4FE8643630F1979371013AC174E96FE0A317BFEC0520FB4F0340F0C22911D19E8F3E6B1
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:50.329 1eb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/21-18:36:50.330 1eb8 Recovering log #3.2024/11/21-18:36:50.330 1eb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):406
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.277348109163873
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12:kT4vYfYeb8rcHEZrELFUt8//DNJ/+//DND5JfYeb8rcHEZrEZSJ:k+YfYeb8nZrExg8/rUrXJfYeb8nZrEZe
                                                                                                                                                                                                                                                                                                        MD5:3AC6FE6390BD3B869D58AFC2FCBDFF74
                                                                                                                                                                                                                                                                                                        SHA1:03583FCB0B5CD2785EC73BAF3AFE9CFBD22B83E6
                                                                                                                                                                                                                                                                                                        SHA-256:A019F9433F4B510FA5CEF152FDA65FA383197FE6D08DE3D85994D04F384F366B
                                                                                                                                                                                                                                                                                                        SHA-512:D0304C2E444AAE2548B56FAF45B1CF7C21F3DFAA77303F7960150820A4FE8643630F1979371013AC174E96FE0A317BFEC0520FB4F0340F0C22911D19E8F3E6B1
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:50.329 1eb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/21-18:36:50.330 1eb8 Recovering log #3.2024/11/21-18:36:50.330 1eb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):331
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.194067651011625
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEzTv+q2Pwkn23oH+Tcwt8a2jMGIFUt8YEzTJjAWZmw+YEzTLG3VkwOwkn23oH+k:k3+vYfYeb8EFUt8/SW/+/GV5JfYeb8bJ
                                                                                                                                                                                                                                                                                                        MD5:14AA05E8236F61EBF9D2302258F2B3EB
                                                                                                                                                                                                                                                                                                        SHA1:12A40001A2FE5A37EB05430253C976CFB091195F
                                                                                                                                                                                                                                                                                                        SHA-256:B62E5488343509DCF27456C72DF04C41C875BC2B194A8335912FC0734806CB9F
                                                                                                                                                                                                                                                                                                        SHA-512:4AB3C88E00CBB77576E1FBC64B274ECF31AF9741AC1FD746E6755EA3D00536DEBF607843DE123E247259A7A0CB2CE74D751A0CDD926A674FB6EEF000D0E603C5
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.291 bec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/21-18:36:49.293 bec Recovering log #3.2024/11/21-18:36:49.298 bec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):331
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.194067651011625
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEzTv+q2Pwkn23oH+Tcwt8a2jMGIFUt8YEzTJjAWZmw+YEzTLG3VkwOwkn23oH+k:k3+vYfYeb8EFUt8/SW/+/GV5JfYeb8bJ
                                                                                                                                                                                                                                                                                                        MD5:14AA05E8236F61EBF9D2302258F2B3EB
                                                                                                                                                                                                                                                                                                        SHA1:12A40001A2FE5A37EB05430253C976CFB091195F
                                                                                                                                                                                                                                                                                                        SHA-256:B62E5488343509DCF27456C72DF04C41C875BC2B194A8335912FC0734806CB9F
                                                                                                                                                                                                                                                                                                        SHA-512:4AB3C88E00CBB77576E1FBC64B274ECF31AF9741AC1FD746E6755EA3D00536DEBF607843DE123E247259A7A0CB2CE74D751A0CDD926A674FB6EEF000D0E603C5
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.291 bec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/21-18:36:49.293 bec Recovering log #3.2024/11/21-18:36:49.298 bec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):57344
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.863060653641558
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
                                                                                                                                                                                                                                                                                                        MD5:C681C90B3AAD7F7E4AF8664DE16971DF
                                                                                                                                                                                                                                                                                                        SHA1:9F72588CEA6569261291B19E06043A1EFC3653BC
                                                                                                                                                                                                                                                                                                        SHA-256:ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
                                                                                                                                                                                                                                                                                                        SHA-512:4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
                                                                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e180364-18f9-4973-a976-c4f9580dae45.tmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):2
                                                                                                                                                                                                                                                                                                        Entropy (8bit):1.0
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:H:H
                                                                                                                                                                                                                                                                                                        MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                                                                        SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                                                                        SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                                                                        SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:[]

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):20480
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                                                                                        MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                                                                                        SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                                                                                        SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                                                                                        SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):61
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.926136109079379
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:YLb9N+eAXRfHDH2LSL:YHpoeSL
                                                                                                                                                                                                                                                                                                        MD5:4DF4574BFBB7E0B0BC56C2C9B12B6C47
                                                                                                                                                                                                                                                                                                        SHA1:81EFCBD3E3DA8221444A21F45305AF6FA4B71907
                                                                                                                                                                                                                                                                                                        SHA-256:E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
                                                                                                                                                                                                                                                                                                        SHA-512:78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"net":{"http_server_properties":{"servers":[],"version":5}}}

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):36864
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.555790634850688
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
                                                                                                                                                                                                                                                                                                        MD5:0247E46DE79B6CD1BF08CAF7782F7793
                                                                                                                                                                                                                                                                                                        SHA1:B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
                                                                                                                                                                                                                                                                                                        SHA-256:AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
                                                                                                                                                                                                                                                                                                        SHA-512:148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):2
                                                                                                                                                                                                                                                                                                        Entropy (8bit):1.0
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:H:H
                                                                                                                                                                                                                                                                                                        MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                                                                        SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                                                                        SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                                                                        SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:[]

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF33b35.TMP (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):2
                                                                                                                                                                                                                                                                                                        Entropy (8bit):1.0
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:H:H
                                                                                                                                                                                                                                                                                                        MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                                                                        SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                                                                        SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                                                                        SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:[]

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):203
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.4042796420747425
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
                                                                                                                                                                                                                                                                                                        MD5:24D66E5F1B8C76C76511DA68057CDE5E
                                                                                                                                                                                                                                                                                                        SHA1:70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
                                                                                                                                                                                                                                                                                                        SHA-256:D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
                                                                                                                                                                                                                                                                                                        SHA-512:1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):36864
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.36515621748816035
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                                                                                                                                                                                                                                                                        MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                                                                                                                                                                                                                                                                        SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                                                                                                                                                                                                                                                                        SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                                                                                                                                                                                                                                                                        SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f03a0f27-8ad4-4bc3-a5a7-d13951984dbc.tmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):2
                                                                                                                                                                                                                                                                                                        Entropy (8bit):1.0
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:H:H
                                                                                                                                                                                                                                                                                                        MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                                                                        SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                                                                        SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                                                                        SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:[]

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):20480
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.46731661083066856
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
                                                                                                                                                                                                                                                                                                        MD5:E93ACF0820CA08E5A5D2D159729F70E3
                                                                                                                                                                                                                                                                                                        SHA1:2C1A4D4924B9AEC1A796F108607404B000877C5D
                                                                                                                                                                                                                                                                                                        SHA-256:F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
                                                                                                                                                                                                                                                                                                        SHA-512:3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):175
                                                                                                                                                                                                                                                                                                        Entropy (8bit):2.874788585530478
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:S8ltHlS+QUl1ASEGhTFljljljljljljl:S85aEFljljljljljljl
                                                                                                                                                                                                                                                                                                        MD5:6153AE3A389CFBA4B2FE34025943EC59
                                                                                                                                                                                                                                                                                                        SHA1:C5762DBAE34261A19EC867FFEA81551757373785
                                                                                                                                                                                                                                                                                                        SHA-256:93C2B2B9CE1D2A2F28FAC5AADC19C713B567DF08EAEEF4167B6543A1CD094A61
                                                                                                                                                                                                                                                                                                        SHA-512:F2367664799162966368C4A480DF6EB4205522EAAE32D861217BA8ED7CFABACBFBB0F7C66433FF6D31EC9638DA66E727E04C2239D7C6A0D5FD3356230E09AB6C
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f...............

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):319
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.1816554234914545
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEzTeDN9+q2Pwkn23oH+TcwtrQMxIFUt8YEzTPp2WZmw+YEzTElVkwOwkn23oH+L:kY+vYfYebCFUt8/J2W/+/qV5JfYebtJ
                                                                                                                                                                                                                                                                                                        MD5:7803B482344F3CA4E594486AF7C81245
                                                                                                                                                                                                                                                                                                        SHA1:CDDBE216E30B2732DDDD2FF5882E5C6EFECA30D8
                                                                                                                                                                                                                                                                                                        SHA-256:7E99C90E5909B82112E82A294F50CD3AF5DB36FA3B7EE3E01EA572E277F19AAC
                                                                                                                                                                                                                                                                                                        SHA-512:448A8D15E2C0C133FB3E88B748C54FAE6C39491BEB39DBD09BA588499E24CCBA1BF2FA1E747B4ADA30ADE247D0B1DE657BC939B37A326910760CB92F9DB485F1
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.616 bec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/21-18:36:49.619 bec Recovering log #3.2024/11/21-18:36:49.621 bec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):319
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.1816554234914545
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEzTeDN9+q2Pwkn23oH+TcwtrQMxIFUt8YEzTPp2WZmw+YEzTElVkwOwkn23oH+L:kY+vYfYebCFUt8/J2W/+/qV5JfYebtJ
                                                                                                                                                                                                                                                                                                        MD5:7803B482344F3CA4E594486AF7C81245
                                                                                                                                                                                                                                                                                                        SHA1:CDDBE216E30B2732DDDD2FF5882E5C6EFECA30D8
                                                                                                                                                                                                                                                                                                        SHA-256:7E99C90E5909B82112E82A294F50CD3AF5DB36FA3B7EE3E01EA572E277F19AAC
                                                                                                                                                                                                                                                                                                        SHA-512:448A8D15E2C0C133FB3E88B748C54FAE6C39491BEB39DBD09BA588499E24CCBA1BF2FA1E747B4ADA30ADE247D0B1DE657BC939B37A326910760CB92F9DB485F1
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.616 bec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/21-18:36:49.619 bec Recovering log #3.2024/11/21-18:36:49.621 bec Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376705811457671

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):230
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.66945425502851
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:37//7tlEcte5PtT+PCX0Jstaad+dvb78KRXBq7Bl:37/TMckZDkJsjsRcl
                                                                                                                                                                                                                                                                                                        MD5:61BCD5004B7FDDE5B7BAEAF1651429E3
                                                                                                                                                                                                                                                                                                        SHA1:7BA14340E110E3F9BBF6D07165B69B449E205D43
                                                                                                                                                                                                                                                                                                        SHA-256:A34584E1DC3877629D050D6386369D87D722A3EF07139A2377BD48C3F2ECB653
                                                                                                                                                                                                                                                                                                        SHA-512:11A9C756B04D82872A8FD123840DF87659CA8A773B5827721A58FDBD08C2508667284F5555961F03BD2EA6A5CB909B3E65CFD7A8C9084413818D490B6C8C66F3
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SNSS.......8a.............8a........"8a.............8a.........8a.........9a.........9a......!..9a.................................8a..9a..1..,...9a..$...1ffc47f4_b86d_45a8_a635_9502795f1d2d...8a.........9a......@..........8a.....

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):350
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.181329217398109
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEzTcKSVq2Pwkn23oH+Tcwt7Uh2ghZIFUt8YEzT80gZmw+YEzT80IkwOwkn23oHT:k0dVvYfYebIhHh2FUt8/k0g/+/k0I5J8
                                                                                                                                                                                                                                                                                                        MD5:F5105F583FC63C0E423A447733A01A2E
                                                                                                                                                                                                                                                                                                        SHA1:4C3581DFE2E83E0061DD4AC4967C92CB44EC01D1
                                                                                                                                                                                                                                                                                                        SHA-256:C5E0E9BBD4BB7EF037B417DAA77C26211390C8F2D6D53558DA296189FED7052E
                                                                                                                                                                                                                                                                                                        SHA-512:82170D4BC6B7ABBF098CA5C0B5616B5FF6076F2B845F2BDE2C3A6CC9B932E1928B9ADE29193ECFB9EE278FF59687FA5FD27CF47ABCDC14D9DA897B1D363CDF39
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.012 1fd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/21-18:36:49.015 1fd4 Recovering log #3.2024/11/21-18:36:49.015 1fd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):350
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.181329217398109
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEzTcKSVq2Pwkn23oH+Tcwt7Uh2ghZIFUt8YEzT80gZmw+YEzT80IkwOwkn23oHT:k0dVvYfYebIhHh2FUt8/k0g/+/k0I5J8
                                                                                                                                                                                                                                                                                                        MD5:F5105F583FC63C0E423A447733A01A2E
                                                                                                                                                                                                                                                                                                        SHA1:4C3581DFE2E83E0061DD4AC4967C92CB44EC01D1
                                                                                                                                                                                                                                                                                                        SHA-256:C5E0E9BBD4BB7EF037B417DAA77C26211390C8F2D6D53558DA296189FED7052E
                                                                                                                                                                                                                                                                                                        SHA-512:82170D4BC6B7ABBF098CA5C0B5616B5FF6076F2B845F2BDE2C3A6CC9B932E1928B9ADE29193ECFB9EE278FF59687FA5FD27CF47ABCDC14D9DA897B1D363CDF39
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.012 1fd4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/21-18:36:49.015 1fd4 Recovering log #3.2024/11/21-18:36:49.015 1fd4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsFl:/F
                                                                                                                                                                                                                                                                                                        MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                                                                        SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                                                                        SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                                                                        SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):270336
                                                                                                                                                                                                                                                                                                        Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                                                                                                                                        MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                                                                        SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                                                                        SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                                                                        SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                                                                                                                        MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                                                                        SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                                                                        SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                                                                        SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                                                                                                                        MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                                                                        SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                                                                        SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                                                                        SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):262512
                                                                                                                                                                                                                                                                                                        Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:LsNlv:Ls3
                                                                                                                                                                                                                                                                                                        MD5:960D2CAE5571C8F5FE1582B05A4A139D
                                                                                                                                                                                                                                                                                                        SHA1:FFEFE0D4F51479CDB016E230683F3D2D6DEE2546
                                                                                                                                                                                                                                                                                                        SHA-256:4914E5BE3AACDFA5FB4DC14F70138238CC390325E3888007509754A5470CB3B9
                                                                                                                                                                                                                                                                                                        SHA-512:4A85D887787562BBF4CBF60D4027E0ED388DD25C7163E8025CD304A5622888C76EE4F0F55FD10D0284C3D31CF242ED756CD12A885A0C1BA9CFC9AB9BDDA745DE
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................Z...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):432
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.265326260698321
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12:kivYfYebvqBQFUt8/r9/+/8Kq5JfYebvqBvJ:koYfYebvZg8/rO8K0JfYebvk
                                                                                                                                                                                                                                                                                                        MD5:08A2FF4F9AAC06FC74241B171965081F
                                                                                                                                                                                                                                                                                                        SHA1:A3B605D7E63621481AB2EB65C1956A644AE1DEA9
                                                                                                                                                                                                                                                                                                        SHA-256:F0309ECC1C3D4DD0E0A4CE017D74241A30D30719A3D844461EB98AA27364FCCC
                                                                                                                                                                                                                                                                                                        SHA-512:CDB6E70AEF8CDA55FE5E345F3AE67BE5866271A6ACF9BB226253B5D5C5C11F521F6F390FA85F6939B4A7585452B353D3FECA827A80DBA86437A44023B108656D
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.602 1634 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/21-18:36:49.604 1634 Recovering log #3.2024/11/21-18:36:49.610 1634 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):432
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.265326260698321
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12:kivYfYebvqBQFUt8/r9/+/8Kq5JfYebvqBvJ:koYfYebvZg8/rO8K0JfYebvk
                                                                                                                                                                                                                                                                                                        MD5:08A2FF4F9AAC06FC74241B171965081F
                                                                                                                                                                                                                                                                                                        SHA1:A3B605D7E63621481AB2EB65C1956A644AE1DEA9
                                                                                                                                                                                                                                                                                                        SHA-256:F0309ECC1C3D4DD0E0A4CE017D74241A30D30719A3D844461EB98AA27364FCCC
                                                                                                                                                                                                                                                                                                        SHA-512:CDB6E70AEF8CDA55FE5E345F3AE67BE5866271A6ACF9BB226253B5D5C5C11F521F6F390FA85F6939B4A7585452B353D3FECA827A80DBA86437A44023B108656D
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.602 1634 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/21-18:36:49.604 1634 Recovering log #3.2024/11/21-18:36:49.610 1634 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2952ae44-c975-4b95-a1c7-59d3566fbed8.tmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):2
                                                                                                                                                                                                                                                                                                        Entropy (8bit):1.0
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:H:H
                                                                                                                                                                                                                                                                                                        MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                                                                        SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                                                                        SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                                                                        SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:[]

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):193
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.864047146590611
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
                                                                                                                                                                                                                                                                                                        MD5:18D8AE83268DD3A59C64AAD659CF2FD3
                                                                                                                                                                                                                                                                                                        SHA1:018C9736438D095A67B1C9953082F671C2FDB681
                                                                                                                                                                                                                                                                                                        SHA-256:D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
                                                                                                                                                                                                                                                                                                        SHA-512:BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):36864
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.555790634850688
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
                                                                                                                                                                                                                                                                                                        MD5:0247E46DE79B6CD1BF08CAF7782F7793
                                                                                                                                                                                                                                                                                                        SHA1:B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
                                                                                                                                                                                                                                                                                                        SHA-256:AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
                                                                                                                                                                                                                                                                                                        SHA-512:148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):2
                                                                                                                                                                                                                                                                                                        Entropy (8bit):1.0
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:H:H
                                                                                                                                                                                                                                                                                                        MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                                                                        SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                                                                        SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                                                                        SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:[]

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):36864
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.36515621748816035
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
                                                                                                                                                                                                                                                                                                        MD5:25363ADC3C9D98BAD1A33D0792405CBF
                                                                                                                                                                                                                                                                                                        SHA1:D06E343087D86EF1A06F7479D81B26C90A60B5C3
                                                                                                                                                                                                                                                                                                        SHA-256:6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
                                                                                                                                                                                                                                                                                                        SHA-512:CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):326
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.2335602213509285
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEzTaZ39+q2Pwkn23oH+TcwtpIFUt8YEzTTUidNJZmw+YEzTgPHH39VkwOwkn23j:ks4vYfYebmFUt8/A+NJ/+/oPn3D5JfYM
                                                                                                                                                                                                                                                                                                        MD5:A50CCAD21D17BF3271A831982A13AADA
                                                                                                                                                                                                                                                                                                        SHA1:32E5C6A3106229B96DBDCE1AF5029F8D0BF6432B
                                                                                                                                                                                                                                                                                                        SHA-256:FDB9584F3891DCE876E45BBDADB94735ABF3FF845A217E0D78909BD71EA943ED
                                                                                                                                                                                                                                                                                                        SHA-512:2353EBB7F8AAA77B8F30911318EF45912C4C2BC0766D16B8BB30BC1BC84410854A9D4B41C6F1AA4F4EFA0FA8F5D307FF5D41F162ED3E0B8359EE497E8F952A14
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.018 1eb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/21-18:36:49.022 1eb8 Recovering log #3.2024/11/21-18:36:49.023 1eb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):326
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.2335602213509285
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEzTaZ39+q2Pwkn23oH+TcwtpIFUt8YEzTTUidNJZmw+YEzTgPHH39VkwOwkn23j:ks4vYfYebmFUt8/A+NJ/+/oPn3D5JfYM
                                                                                                                                                                                                                                                                                                        MD5:A50CCAD21D17BF3271A831982A13AADA
                                                                                                                                                                                                                                                                                                        SHA1:32E5C6A3106229B96DBDCE1AF5029F8D0BF6432B
                                                                                                                                                                                                                                                                                                        SHA-256:FDB9584F3891DCE876E45BBDADB94735ABF3FF845A217E0D78909BD71EA943ED
                                                                                                                                                                                                                                                                                                        SHA-512:2353EBB7F8AAA77B8F30911318EF45912C4C2BC0766D16B8BB30BC1BC84410854A9D4B41C6F1AA4F4EFA0FA8F5D307FF5D41F162ED3E0B8359EE497E8F952A14
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.018 1eb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/21-18:36:49.022 1eb8 Recovering log #3.2024/11/21-18:36:49.023 1eb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):28672
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.26707851465859517
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
                                                                                                                                                                                                                                                                                                        MD5:04F8B790DF73BD7CD01238F4681C3F44
                                                                                                                                                                                                                                                                                                        SHA1:DF12D0A21935FC01B36A24BF72AB9640FEBB2077
                                                                                                                                                                                                                                                                                                        SHA-256:96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
                                                                                                                                                                                                                                                                                                        SHA-512:0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):180224
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.9312584730793054
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:192:CSqzyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:CrzyffrnzkkqtXnTK+hNH+5
                                                                                                                                                                                                                                                                                                        MD5:4ECC14F9549C4BB53159212C5BCC9CC0
                                                                                                                                                                                                                                                                                                        SHA1:EFEABE631F20B60E2863952BFF0F485BEB74CE36
                                                                                                                                                                                                                                                                                                        SHA-256:49F613160AD871F1B44381BB8F6B4E1EB481E41A86B462D4CD29CB90095EE149
                                                                                                                                                                                                                                                                                                        SHA-512:6EB988D5F9AA19A26EB1AE4E87F1D2E03D407B969777AB38E2031B3556D8915CCBD4BE6BD537A1A1D22A365D58CDF63E3B790D8AB7281DCCAC09F9685A0788C7
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):2568
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.06569804787746028
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:qEpolFl1lhtl0EB:qEyF3kEB
                                                                                                                                                                                                                                                                                                        MD5:2E18214378DA9905A6D4312BC084D216
                                                                                                                                                                                                                                                                                                        SHA1:679A8EB4B9598B2062F587921A2623EE1FF98003
                                                                                                                                                                                                                                                                                                        SHA-256:259FCC876488C8436EBFBB1369363E472889863A5740EDE85ACAB0420554E509
                                                                                                                                                                                                                                                                                                        SHA-512:98647F6C86867ED24175C3402CB8850AEDB2B278AF013A60E990345C7160C9DDF74F2AFCFB3329A58FA092C17FA8C41F1AAFDEF2855E7EF4D96FF459918ABB1F
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:...................W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (3852), with CRLF line terminators
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):11417
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.237554345326078
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:192:dH4vrmORnBtW4PoiUDNaxvR5FCHFcoaSbqGEDu:dH4vrmonPW4jR3GaSbqGEDu
                                                                                                                                                                                                                                                                                                        MD5:DF790948C5A7B5DD19D033FE6C793868
                                                                                                                                                                                                                                                                                                        SHA1:0C4A681E07505CA84997CE78FEEE1F0D88CB8E2A
                                                                                                                                                                                                                                                                                                        SHA-256:CB4049061A6A78013D20CC4AB396BEF4F6C35306887BE76765EED4E51EEE702D
                                                                                                                                                                                                                                                                                                        SHA-512:251C3B5DE5452E2F40C648BDB2E3D1CE2315DD4DFFAF4B4E5E08528DBAAB80535F1A82E183A65AB7DCA0C2926AE5D6B61F06DB390D0E3B8D8E77E826B21042CB
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{.. "ArbitrationSignal": "(time_elapsed_since_last_notification)-3600^(notification_quick_dismiss_rate_lower_ci+notification_disable_rate+notification_snooze_rate)",.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f41

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\baa22ca8-f3ac-44a3-8000-6acbc9170c12.tmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:very short file (no magic)
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):1
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.0
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:L:L
                                                                                                                                                                                                                                                                                                        MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                                                                                                                                        SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                                                                                                                                        SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                                                                                                                                        SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fb09be20-15d0-4858-bbab-9399f048277f.tmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:very short file (no magic)
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):1
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.0
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:L:L
                                                                                                                                                                                                                                                                                                        MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                                                                                                                                        SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                                                                                                                                        SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                                                                                                                                        SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):16
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                                                                                        MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                                        SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                                        SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                                        SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):16
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                                                                                        MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                                        SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                                        SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                                        SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):281
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.245049594036355
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEzTkOs1wkn23oH+Tcwtfrl2KLlVEzTi+q2Pwkn23oH+TcwtfrK+IFUv:kNLfYeb1LsbvYfYeb23FUv
                                                                                                                                                                                                                                                                                                        MD5:2ED1FC5BBD539FC8B8888B5737BC4230
                                                                                                                                                                                                                                                                                                        SHA1:2518AA15D6F113B52E12089CFA33B8E87EABD58F
                                                                                                                                                                                                                                                                                                        SHA-256:B3B4423F1017992DA1ECA1F35F81AB69FAD276B6A0523704F9AD44570BA3C4C3
                                                                                                                                                                                                                                                                                                        SHA-512:FADF144F78378D0C9ACA73013D1F75D2673074D1D88B4C302BCD00806F9EDACD9165FC0B0036F96AC143F03F5BDAEAB8FD96E67A030B689C49407B492AE39C32
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.540 1fe8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/11/21-18:36:49.838 1fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):41
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                                                                                                                        MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                                        SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                                        SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                                        SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):16
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                                                                                        MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                                        SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                                        SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                                        SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):184
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.7064843374216494
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:G0XttkJcsRwI9tkJcsIap3mEaXe/tlfmo1cgtfmEbQJkZt/fmoG:G0XtqcsqcpS3m9XOPmQ1mdkZt3mh
                                                                                                                                                                                                                                                                                                        MD5:B35D474DF6A64D3841ECDF798DBE93FF
                                                                                                                                                                                                                                                                                                        SHA1:DD4C3D2FDC5997B6DF5FB619420125F8D12D5449
                                                                                                                                                                                                                                                                                                        SHA-256:924C5DED0B3D90B90AE8D7EC72CF1FCBEDF69402A2DF3302E462495D47D6BD1D
                                                                                                                                                                                                                                                                                                        SHA-512:C4CFAEFB6DC71762ABEB055240B9D64F7EC573BA0FD165277DEF2658B8D605B78EEEE37092840731AA687CEFEF55341595A08CBD3871E32D02182F8EFE82159F
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.h.6.................__global... .t...................__global... ..'i..................21_.....B....................33_......-.t.................21_......'..................33_.....

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):16
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                                                                                        MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                                        SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                                        SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                                        SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):299
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.214863985220641
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:HEzTk8ys1wkn23oH+Tcwtfrzs52KLlVEzTkWf+q2Pwkn23oH+TcwtfrzAdIFUv:kPyLfYebs9LsWvYfYeb9FUv
                                                                                                                                                                                                                                                                                                        MD5:1ACD20B56BF95909DB29EEFA865D64AD
                                                                                                                                                                                                                                                                                                        SHA1:7A3E6D021DAAC078FF8FD165EB2D4A632DF914AC
                                                                                                                                                                                                                                                                                                        SHA-256:0EE2A48431AC48FE30F920C1DBF9FB221BC2391A8D633086DB222351F3FE30C6
                                                                                                                                                                                                                                                                                                        SHA-512:67E1C616D349BB7C12DF90D62B6432402A344451987F1EBC76ACA9524E52EE6ECF7AE12F8059B2851E588E107F09BD95B1A0C1D410B9420613287BBB7C89105A
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:2024/11/21-18:36:49.503 1fe8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/11/21-18:36:49.536 1fe8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):41
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                                                                                                                        MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                                        SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                                        SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                                        SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsFl:/F
                                                                                                                                                                                                                                                                                                        MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                                                                        SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                                                                        SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                                                                        SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):270336
                                                                                                                                                                                                                                                                                                        Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                                                                                                                                        MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                                                                        SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                                                                        SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                                                                        SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                                                                                                                        MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                                                                        SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                                                                        SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                                                                        SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                                                                                                                        MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                                                                        SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                                                                        SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                                                                        SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):262512
                                                                                                                                                                                                                                                                                                        Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:LsNlHjq:Ls3D
                                                                                                                                                                                                                                                                                                        MD5:5A1C71249EF76E2DFF373902C91D1746
                                                                                                                                                                                                                                                                                                        SHA1:243A667C7E696538C05FFAD698FCF48DAB1950FD
                                                                                                                                                                                                                                                                                                        SHA-256:D2D3D8BFECBF9057B70EA0F80ED8886054B087BAF6E64F01C9B73E104E2D8168
                                                                                                                                                                                                                                                                                                        SHA-512:4AF1A112A1D8DBB8C313CB07F593D9EE0CC17D181115500620F581B0C92F96948CE1458D907223BF6CB119E1A8FD4CB55BEDD7DEC7078A262E4181B23CF7BD32
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.........................................m..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsFl:/F
                                                                                                                                                                                                                                                                                                        MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                                                                        SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                                                                        SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                                                                        SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):270336
                                                                                                                                                                                                                                                                                                        Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                                                                                                                                        MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                                                                        SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                                                                        SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                                                                        SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                                                                                                                        MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                                                                        SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                                                                        SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                                                                        SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                                                                                                                        MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                                                                        SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                                                                        SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                                                                        SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):262512
                                                                                                                                                                                                                                                                                                        Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:LsNlwauCt:Ls3wax
                                                                                                                                                                                                                                                                                                        MD5:908DAB84B32BCED6A18216E0960A54C2
                                                                                                                                                                                                                                                                                                        SHA1:0A6DF35B2C46B9720C71005F60D79A615E33E148
                                                                                                                                                                                                                                                                                                        SHA-256:0854B8E103D8275DEC5B330C71C8DC9E8561B664D27A5C2B95BA6A6C2820557E
                                                                                                                                                                                                                                                                                                        SHA-512:B1C9C2B965E3F8526AA544C792DF338BB7153B28AE9CE0E942C5916F396C8F062166B3C40E01C8DF09E2DA8DA76F9D3C7B98739A1B9C3CE6CFA65319BABC6A7F
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................V...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):13
                                                                                                                                                                                                                                                                                                        Entropy (8bit):2.7192945256669794
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:NYLFRQI:ap2I
                                                                                                                                                                                                                                                                                                        MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                                                                                                                                                                                                                                                                                                        SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                                                                                                                                                                                                                                                                                                        SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                                                                                                                                                                                                                                                                                                        SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:117.0.2045.47

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):6820
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.793431352475268
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:96:iaqkHf7Cva+5ih/cI9URLl8RotovMFVvlwh2e4IbONIeTC6XQS0qGqk+Z4uj+rj1:akzCvOeiRUwhW6qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                                                                                                                        MD5:93DD77C3C62262584CF9B02B33411D7D
                                                                                                                                                                                                                                                                                                        SHA1:84E0CF5DE0756B2684DB296C96F40EBB9336C89D
                                                                                                                                                                                                                                                                                                        SHA-256:AAFD7E769D2B71EE2A5F3142CC8499570C78C32BFAD9513F1F32A12F0BA66A1A
                                                                                                                                                                                                                                                                                                        SHA-512:5DE9641141E2C900EDBDA545FC1281C8B90028A484853E37697EABE57FA50EEF1A7E4BC2EE791C2BFD87151E84F3B9F5B1D79ABE3B4018F9414A87EC04A963B5
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA7nGpp1gOERJDFeCbMTomaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADByQ180GX5OjXu5Dvv+a5cTd+8CRY5HwgLoQtRHUrZyQAAAAA

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF331df.TMP (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):6820
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.793431352475268
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:96:iaqkHf7Cva+5ih/cI9URLl8RotovMFVvlwh2e4IbONIeTC6XQS0qGqk+Z4uj+rj1:akzCvOeiRUwhW6qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                                                                                                                        MD5:93DD77C3C62262584CF9B02B33411D7D
                                                                                                                                                                                                                                                                                                        SHA1:84E0CF5DE0756B2684DB296C96F40EBB9336C89D
                                                                                                                                                                                                                                                                                                        SHA-256:AAFD7E769D2B71EE2A5F3142CC8499570C78C32BFAD9513F1F32A12F0BA66A1A
                                                                                                                                                                                                                                                                                                        SHA-512:5DE9641141E2C900EDBDA545FC1281C8B90028A484853E37697EABE57FA50EEF1A7E4BC2EE791C2BFD87151E84F3B9F5B1D79ABE3B4018F9414A87EC04A963B5
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA7nGpp1gOERJDFeCbMTomaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADByQ180GX5OjXu5Dvv+a5cTd+8CRY5HwgLoQtRHUrZyQAAAAA

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3323c.TMP (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):6820
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.793431352475268
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:96:iaqkHf7Cva+5ih/cI9URLl8RotovMFVvlwh2e4IbONIeTC6XQS0qGqk+Z4uj+rj1:akzCvOeiRUwhW6qRAq1k8SPxVLZ7VTiq
                                                                                                                                                                                                                                                                                                        MD5:93DD77C3C62262584CF9B02B33411D7D
                                                                                                                                                                                                                                                                                                        SHA1:84E0CF5DE0756B2684DB296C96F40EBB9336C89D
                                                                                                                                                                                                                                                                                                        SHA-256:AAFD7E769D2B71EE2A5F3142CC8499570C78C32BFAD9513F1F32A12F0BA66A1A
                                                                                                                                                                                                                                                                                                        SHA-512:5DE9641141E2C900EDBDA545FC1281C8B90028A484853E37697EABE57FA50EEF1A7E4BC2EE791C2BFD87151E84F3B9F5B1D79ABE3B4018F9414A87EC04A963B5
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA7nGpp1gOERJDFeCbMTomaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADByQ180GX5OjXu5Dvv+a5cTd+8CRY5HwgLoQtRHUrZyQAAAAA

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):20480
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.46731661083066856
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
                                                                                                                                                                                                                                                                                                        MD5:E93ACF0820CA08E5A5D2D159729F70E3
                                                                                                                                                                                                                                                                                                        SHA1:2C1A4D4924B9AEC1A796F108607404B000877C5D
                                                                                                                                                                                                                                                                                                        SHA-256:F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
                                                                                                                                                                                                                                                                                                        SHA-512:3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsFl:/F
                                                                                                                                                                                                                                                                                                        MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                                                                        SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                                                                        SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                                                                        SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):270336
                                                                                                                                                                                                                                                                                                        Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsEllllkEthXllkl2:/M/xT02
                                                                                                                                                                                                                                                                                                        MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                                                                        SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                                                                        SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                                                                        SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsHlDll:/H
                                                                                                                                                                                                                                                                                                        MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                                                                        SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                                                                        SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                                                                        SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:MsGl3ll:/y
                                                                                                                                                                                                                                                                                                        MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                                                                        SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                                                                        SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                                                                        SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):262512
                                                                                                                                                                                                                                                                                                        Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:LsNlbK//:Ls3b
                                                                                                                                                                                                                                                                                                        MD5:929B5EAE8084E11039F579A29A873ED1
                                                                                                                                                                                                                                                                                                        SHA1:7E6CA380ED214A9D218E3B742513AF3744C49908
                                                                                                                                                                                                                                                                                                        SHA-256:62B63B05F0467B522B637EC75F9E5CCD0CC04A0F371465D8E35B97FEB432FBF7
                                                                                                                                                                                                                                                                                                        SHA-512:56832172BEE789482D7DA8498C4E65F3ADF89682ECCECECF8D320E565F636C03D3D808CD039C076F7562593E4CD3A042820692C8DF3010C1E241574C8FB67564
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):47
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.3818353308528755
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
                                                                                                                                                                                                                                                                                                        MD5:48324111147DECC23AC222A361873FC5
                                                                                                                                                                                                                                                                                                        SHA1:0DF8B2267ABBDBD11C422D23338262E3131A4223
                                                                                                                                                                                                                                                                                                        SHA-256:D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
                                                                                                                                                                                                                                                                                                        SHA-512:E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):35
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.014438730983427
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
                                                                                                                                                                                                                                                                                                        MD5:BB57A76019EADEDC27F04EB2FB1F1841
                                                                                                                                                                                                                                                                                                        SHA1:8B41A1B995D45B7A74A365B6B1F1F21F72F86760
                                                                                                                                                                                                                                                                                                        SHA-256:2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
                                                                                                                                                                                                                                                                                                        SHA-512:A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"forceServiceDetermination":false}

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):29
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.922828737239167
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:2NGw+K+:fwZ+
                                                                                                                                                                                                                                                                                                        MD5:7BAAFE811F480ACFCCCEE0D744355C79
                                                                                                                                                                                                                                                                                                        SHA1:24B89AE82313084BB8BBEB9AD98A550F41DF7B27
                                                                                                                                                                                                                                                                                                        SHA-256:D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
                                                                                                                                                                                                                                                                                                        SHA-512:70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:customSynchronousLookupUris_0

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):35302
                                                                                                                                                                                                                                                                                                        Entropy (8bit):7.99333285466604
                                                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                                                        SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                                                                                                                                                                                                                                        MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                                                                                                                                                                                                                                        SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                                                                                                                                                                                                                                        SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                                                                                                                                                                                                                                        SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):18
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.5724312513221195
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:kDnaV6bVon:kDYa2
                                                                                                                                                                                                                                                                                                        MD5:5692162977B015E31D5F35F50EFAB9CF
                                                                                                                                                                                                                                                                                                        SHA1:705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
                                                                                                                                                                                                                                                                                                        SHA-256:42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
                                                                                                                                                                                                                                                                                                        SHA-512:32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:edgeSettings_2.0-0

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):3581
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.459693941095613
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
                                                                                                                                                                                                                                                                                                        MD5:BDE38FAE28EC415384B8CFE052306D6C
                                                                                                                                                                                                                                                                                                        SHA1:3019740AF622B58D573C00BF5C98DD77F3FBB5CD
                                                                                                                                                                                                                                                                                                        SHA-256:1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
                                                                                                                                                                                                                                                                                                        SHA-512:9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):47
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.493433469104717
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:kfKbQSQSuLA5:kyUc5
                                                                                                                                                                                                                                                                                                        MD5:3F90757B200B52DCF5FDAC696EFD3D60
                                                                                                                                                                                                                                                                                                        SHA1:569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
                                                                                                                                                                                                                                                                                                        SHA-256:1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
                                                                                                                                                                                                                                                                                                        SHA-512:39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:synchronousLookupUris_636976985063396749.rel.v2

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):35302
                                                                                                                                                                                                                                                                                                        Entropy (8bit):7.99333285466604
                                                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                                                        SSDEEP:768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
                                                                                                                                                                                                                                                                                                        MD5:0E06E28C3536360DE3486B1A9E5195E8
                                                                                                                                                                                                                                                                                                        SHA1:EB768267F34EC16A6CCD1966DCA4C3C2870268AB
                                                                                                                                                                                                                                                                                                        SHA-256:F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
                                                                                                                                                                                                                                                                                                        SHA-512:45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-.*.F.1....g|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a.*...6g3..%.gy../{|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...|$....;.k.......*8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl.....*...}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):50
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.9904355005135823
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:0xXF/XctY5GUf+:0RFeUf+
                                                                                                                                                                                                                                                                                                        MD5:E144AFBFB9EE10479AE2A9437D3FC9CA
                                                                                                                                                                                                                                                                                                        SHA1:5AAAC173107C688C06944D746394C21535B0514B
                                                                                                                                                                                                                                                                                                        SHA-256:EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
                                                                                                                                                                                                                                                                                                        SHA-512:837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:topTraffic_170540185939602997400506234197983529371

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):575056
                                                                                                                                                                                                                                                                                                        Entropy (8bit):7.999649474060713
                                                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
                                                                                                                                                                                                                                                                                                        MD5:BE5D1A12C1644421F877787F8E76642D
                                                                                                                                                                                                                                                                                                        SHA1:06C46A95B4BD5E145E015FA7E358A2D1AC52C809
                                                                                                                                                                                                                                                                                                        SHA-256:C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
                                                                                                                                                                                                                                                                                                        SHA-512:FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)*d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(|.6.:..f!.>...?M.8......P.D.J.I4.<...*.y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z*.{nZ~d.V.4.u.K.V.......X.<p..cz..>*....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):87
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.415446034314543
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:YQ3JYq9xSs0dMEJAELJ2rjozQd:YQ3Kq9X0dMgAEwjj
                                                                                                                                                                                                                                                                                                        MD5:3FA87FFDBFD627F217A5F052D6D3A7AC
                                                                                                                                                                                                                                                                                                        SHA1:0746F46DE416E30212C78E240BF6B5352EE2EF9C
                                                                                                                                                                                                                                                                                                        SHA-256:7C782809649AE44D26AD9EC63F900A8B306E91ED01410EEDD6A9AB778770ED2B
                                                                                                                                                                                                                                                                                                        SHA-512:EDAEDD2E75B29829BE86D25CB0D894832FCA323FD12493133E9230007D3FA353F12F3DBC87DAD9FE2B86D0F26EC3814C9951975ADFF3421623C44642AA780894
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":14}

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c4eb8bf5-277d-4d13-8fd4-bf76d9ac572b.tmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8307
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.79482289830651
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:192:fsNAzCvReiRUXqQXklkt6qRAq1k8SPxVLZ7VTiQ:fsNAevhgzUlC6q3QxVNZTiQ
                                                                                                                                                                                                                                                                                                        MD5:A5D8E8D3C5B8A1F3492BD904D47E37E0
                                                                                                                                                                                                                                                                                                        SHA1:268C6A6A30E1F8E47EC0A66F942B8721BD02CC0D
                                                                                                                                                                                                                                                                                                        SHA-256:6D16261DCD0DE7C9909D4D7DDA04662118569B68AD8C4112DC0008538AAA5196
                                                                                                                                                                                                                                                                                                        SHA-512:A8D4D698CD6A596E633CAA71B5A208B0604ABE968E579F4A8FF8C8F08F99B95559CD033AF0E22FAFBC6251EE32CA600128AE79FBF5142022D5E94324BDEF3482
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):2278
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.8503628373917262
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:48:uiTrlKxrgxhxl9Il8uUWDb0p6KTz2w61IW7yRfsol1ucid1rc:mUYCWf0p6XeRfsolEcB
                                                                                                                                                                                                                                                                                                        MD5:BF635CF4A19B1CA1E7FCF960E33EC382
                                                                                                                                                                                                                                                                                                        SHA1:D2D547ECCAB25B29C08B18C2C2FF25B4FB792680
                                                                                                                                                                                                                                                                                                        SHA-256:E2DDD312CCD07D301CB17953F8DE68133526EAD3F1D4B0D35523586F5267B889
                                                                                                                                                                                                                                                                                                        SHA-512:1A5619B14009084B51EA50AE9BCC1D1E6C84D95AFD794101B885320B52B8A9B92D79ABD0D5C95DAF769FE83421A9E995F9A19A435AE500CD1DB9D37C109F7815
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.B.M.Q.n.3.Y.8.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.O.5.x.q.a.d.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):4622
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.997224512436986
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:96:4YCWg3tKYtrJcfG70rlbvgk+94gr22FQ8Yf:4p3tKYtrCby2gy2TYf
                                                                                                                                                                                                                                                                                                        MD5:C455371B6D2E815B9465C6F9A4156BA8
                                                                                                                                                                                                                                                                                                        SHA1:3766456A18FECF7C2F1A30FB54D6D3DACE736B54
                                                                                                                                                                                                                                                                                                        SHA-256:66E3429C3AD9FAC5A87A3364660ACA89CBBBF7BCA922B338B18952571BB05610
                                                                                                                                                                                                                                                                                                        SHA-512:0BF580604142E4B676AD882A9A70D59A0F5872E1040B8EF4E2C76257293AE2A862D6B3E4A63CEE5007D357680247E7FA7A6EB91D1154FA4B4AD0C12EA3456E7A
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".N.f.0.C.h.W.4.8.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.O.5.x.q.a.d.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):2684
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.90450541196299
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:48:uiTrlKx68Wa7xgxl9Il8uUWDZZy7okBBkrsB5KxnZzQs5ld/vc:aiYCWulBBkrw5KxnZznE
                                                                                                                                                                                                                                                                                                        MD5:66995012DF795DEFBCC41A861DA672D0
                                                                                                                                                                                                                                                                                                        SHA1:8BC899B6279CAEE52385029BCFE47F4C107A0E25
                                                                                                                                                                                                                                                                                                        SHA-256:B048CB6EE192889B44D14B0E34CA0FF6D94013730FE2462EDA5567FEC517AC0D
                                                                                                                                                                                                                                                                                                        SHA-512:4493011E3599361956B42D7FB22E4BE91BE563BC99DA5D7CB23D5BEED1080F306C07705A1E02E71E765DCA2999093504DAB52921F9D2F9E17DE5DD0644BB1D99
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.B.L.B.t.T.9.b.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.O.5.x.q.a.d.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Programs\unrealgame\LICENSE.electron.txt

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):1096
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                                                                                                        MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                                                                                                        SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                                                                                                        SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                                                                                                        SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Programs\unrealgame\LICENSES.chromium.html

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:HTML document, ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8315859
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.706254155756507
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:24576:dbTq6T06T5kJWSIRWnBIl70mfT76y6E65606F/HXpErpem:t4scj
                                                                                                                                                                                                                                                                                                        MD5:8303B3A19888F41062A614CD95B2E2D2
                                                                                                                                                                                                                                                                                                        SHA1:A112EE5559C27B01E3114CF10050531CAB3D98A6
                                                                                                                                                                                                                                                                                                        SHA-256:9C088CAAC76CF5BE69E0397D76FE9397017585CFFDBA327692FF1B3A6C00D68F
                                                                                                                                                                                                                                                                                                        SHA-512:281B2ECC99502A050EE69E31256DEC135E8CB877D1A6BA9F1C975FCFB11C062980EE6061D2368B62F91E392953AE6235DD726A9D98E6EFC1302F7ED713099179
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):162117120
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.733463680381509
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:1572864:ATmw0ciLNpDPuAvHxJLkY2O6Ea3f9kwZXeT6EivLp1vUAtdjtZn+f4FnIvGaC9dU:zv6E70+Mk
                                                                                                                                                                                                                                                                                                        MD5:DF1D5E605E98A3A533E6AD7E585442E0
                                                                                                                                                                                                                                                                                                        SHA1:2AE91812D80243C2F7B24626FC73E1F7E183D336
                                                                                                                                                                                                                                                                                                        SHA-256:8158D75859986B7F7ED3A6B2A185CDAF95CF6F4476F7C66FED403FDDADE3B01C
                                                                                                                                                                                                                                                                                                        SHA-512:77AFC7AA057FAB4A96283DAE6B85CF4F1F494C3CCA9534AC7199EC07B0D20BE643020E4A86DA672ADD65B0BDD8A486245D4C9215240357AFB5F22E39822A0D33
                                                                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 8%
                                                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e..........".................P..........@..........................................`...........................................I.. ....M.h............p...f@..........`........?.......................?.(... !..@.............M.......I......................text............................... ..`.rdata..h.n.......n.................@..@.data....TB...Q.......P.............@....pdata...f@..p...h@...X.............@..@.00cfg..0............ ..............@..@.gxfg...pA.......B..."..............@..@.retplne.....@.......d...................rodata......P.......f.............. ..`.tls.........p.......x..............@...CPADinfo8............|..............@...LZMADEC..............~.............. ..`_RDATA..\...........................@..@malloc_h+........................... ..`.rsrc...............................@..@.reloc.......`......................@..B................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Programs\unrealgame\chrome_100_percent.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):127125
                                                                                                                                                                                                                                                                                                        Entropy (8bit):7.915612661029362
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:vlKzwqCT4wDNzIwL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:vlKzwt4uEgK18Gb0OV8ld0GecQ3f2
                                                                                                                                                                                                                                                                                                        MD5:ACD0FA0A90B43CD1C87A55A991B4FAC3
                                                                                                                                                                                                                                                                                                        SHA1:17B84E8D24DA12501105B87452F86BFA5F9B1B3C
                                                                                                                                                                                                                                                                                                        SHA-256:CCBCA246B9A93FA8D4F01A01345E7537511C590E4A8EFD5777B1596D10923B4B
                                                                                                                                                                                                                                                                                                        SHA-512:3E4C4F31C6C7950D5B886F6A8768077331A8F880D70B905CF7F35F74BE204C63200FF4A88FA236ABCCC72EC0FC102C14F50DD277A30F814F35ADFE5A7AE3B774
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:..............t...#.....:.I...J~p...K~6...L~....M~#...N~....O~`...P~m...Q~....R~....S~I...T~....U~'"..V~.,..^~.7.._~;9..b~v:..c~(<..j~.<..k~.B..l~fH..m~.J..n~.K..o~.L.....M.....N....aP....IS....BV....uY.....]....Pa.....d....h....i...hk....l....m...An....n.....................................K.....x...........4.....m.....D.............................1........................'.....*.....4.....>.....C.....D....hM.....U.....V....>X.....Z....E].....]....a...%c....d....f....h....i....k....l....o...wq....t...7v....y....}....~...m................................3.................g.....6............................k.....-...........3.....9......................H.......................Y.................{.....s....M..............F...................&....y..............\....p....Z.........Z.........g...........................T..................6...............M.................r...........1.................X.................u.......

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Programs\unrealgame\chrome_200_percent.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):177406
                                                                                                                                                                                                                                                                                                        Entropy (8bit):7.939611912805236
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:4DQYaEQN6AJPKNzIwafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/rIM0:4DQYaNN68QEVgx5GMRejnbdZnVE6YopY
                                                                                                                                                                                                                                                                                                        MD5:4610337E3332B7E65B73A6EA738B47DF
                                                                                                                                                                                                                                                                                                        SHA1:8D824C9CF0A84AB902E8069A4DE9BF6C1A9AAF3B
                                                                                                                                                                                                                                                                                                        SHA-256:C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
                                                                                                                                                                                                                                                                                                        SHA-512:039B50284D28DCD447E0A486A099FA99914D29B543093CCCDA77BBEFDD61F7B7F05BB84B2708AE128C5F2D0C0AB19046D08796D1B5A1CFF395A0689AB25CCB51
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:..............t...#.....:.t...J~....K~....L~....M~....N~....O~....P~.%..Q~.*..R~.-..S~c5..T~.9..U~.A..V~.V..^~Ck.._~.m..b~)o..c~yr..j~#s..k~.}..l~....m~...n~...o~......................................K.....!..................Q..............*........................a.......................,%....H0.....2....E:....(A.....F.....L.....R.....T....QY....:].....f.....i....br....Sv..........C...........).................].....}................................................................................................. ....!....%.....*.....,..........O/...../....y1.....2....l4.....6.....7....A:.....?.....C.....K.....S.....Y....._.....e....Ok.....l.....m.....n.....o.....q.....r.....s.....u....:w..............P............................%.............7................,........G........u.............B........S.........a....%........;.....................l...........T..........R...........6..........).............

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Programs\unrealgame\d3dcompiler_47.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):4916712
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.398049523846958
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                                                                                                                                        MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                                                                                                                                        SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                                                                                                                                        SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                                                                                                                                        SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                                                                                                                        • Filename: Xa04iTOvv5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                        • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                        • Filename: ArenaWarsSetup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                        • Filename: ArenaWarsSetup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                        • Filename: Launcher 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                        • Filename: Launcher 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                        • Filename: Xeno Executor Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                        • Filename: Xeno Executor Setup 1.0.0.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                        • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                        • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Programs\unrealgame\ffmpeg.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):2882560
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.699294130576871
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:49152:WdTodIrn9wbFV6Ps2cA7SJ/W1C1fLPzhkE7hjU7gUxGJwDw3lCQTQY/N3lzl3heH:C79fe/CmP6w3lXQYef/3
                                                                                                                                                                                                                                                                                                        MD5:A007299C49FA50AEFF594655859780AE
                                                                                                                                                                                                                                                                                                        SHA1:D202F1F617023763A0E9418878E8ECAC96BE9FD4
                                                                                                                                                                                                                                                                                                        SHA-256:B78F0036621AD1D5833289F2AD509963EF78F1A89A3C7DF0F1370FD2D35A2804
                                                                                                                                                                                                                                                                                                        SHA-512:444C4BAA1E1D941BD04F78184CEC519C6EB53A83FBC3AA3EA30522BFFC9ECDE73EBE7B910C1A37C345429298ADA3C0FFCB3E3849E21B2009487B5CD1A02CB2A9
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ....."#..................................................@B...........`A..........................................*.......*.(.............@...............B..3....).......................).(....R#.@............"*.P............................text....!#......"#................. ..`.rdata..D....@#......&#.............@..@.data.........*.."....*.............@....pdata........@.......*.............@..@.00cfg..8.....A.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...3....B..4....+.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Programs\unrealgame\icudtl.dat

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):10544880
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.276833777601164
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:98304:GKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8j:GKPBhORjOhCliXUxiG9Ha93Whla6ZGr4
                                                                                                                                                                                                                                                                                                        MD5:2134E5DBC46FB1C46EAC0FE1AF710EC3
                                                                                                                                                                                                                                                                                                        SHA1:DBECF2D193AE575ABA4217194D4136BD9291D4DB
                                                                                                                                                                                                                                                                                                        SHA-256:EE3C8883EFFD90EDFB0FF5B758C560CBCA25D1598FCB55B80EF67E990DD19D41
                                                                                                                                                                                                                                                                                                        SHA-512:B9B50614D9BAEBF6378E5164D70BE7FE7EF3051CFFF38733FE3C7448C5DE292754BBBB8DA833E26115A185945BE419BE8DD1030FC230ED69F388479853BC0FCB
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Programs\unrealgame\libEGL.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):480768
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.335610382348666
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:afuE2DT96QHENooSYBjLkt4sasMHemPwlrX+nZiML7hn:afuE2DbkGoS2jLku/wWUiNn
                                                                                                                                                                                                                                                                                                        MD5:CA5BB0794B7700601E9438283D458665
                                                                                                                                                                                                                                                                                                        SHA1:7FCF090B19820B9450937BE800575C526448B581
                                                                                                                                                                                                                                                                                                        SHA-256:4A8BE3B4D9FE790EFDCE38CFF8F312A2F8276908D6703E0C6C37818E217CF1E3
                                                                                                                                                                                                                                                                                                        SHA-512:36EBAB858FE7E014837548575389E7DF2E86676888E4A9039C736D0F2E6463102E68989B794D949DDB16D9BCCE43CE55737FCF2A4B09B1667BF968A9540E9F32
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ....."..........`.....................................................`A........................................00......F>..(.......x.... ...C..............0....(.......................'..(...@A..@...........pA...............................text....!.......".................. ..`.rdata......@.......&..............@..@.data....L....... ..................@....pdata...C... ...D..................@..@.00cfg..8....p......................@..@.gxfg...`$.......&..................@..@.retplne.............<...................tls....!............>..............@..._RDATA..\............@..............@..@.rsrc...x............B..............@..@.reloc..0............H..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Programs\unrealgame\libGLESv2.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):7626240
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.463446463154237
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:98304:WJTPQhRQ4t2fzqJ3IZ155Rl5F/tpcAgsOMN:Wm2foIzRJosr
                                                                                                                                                                                                                                                                                                        MD5:05B585464F18FE0E3BDDB20527697D66
                                                                                                                                                                                                                                                                                                        SHA1:8BCEC2F0B409AFA9FF054E25F3CE85EB9BD50010
                                                                                                                                                                                                                                                                                                        SHA-256:0BB7C6C08B569C1D2DE90A40E6C142591E160A7C6CB15D21807F3404A48C4287
                                                                                                                                                                                                                                                                                                        SHA-512:F680AB9C3070F443C7359BB3F0C2032F5C58C88C7823E4592E8212CE8815EA5F463C86DF113F5320944C62D3CB4E8D45B9B4DCAADCCC1AC9BF203AE4BB52083C
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ......Z......... .M......................................`u...........`A........................................M.k.8.....l.d....pt.......q.`O............t......wk......................uk.(.....Z.@.............l.....p.k.@....................text....Z.......Z................. ..`.rdata..$.....Z.......Z.............@..@.data.........m..|....m.............@....pdata..`O....q..P....q.............@..@.00cfg..8.....t......Rs.............@..@.gxfg....+....t..,...Ts.............@..@.retplne.....@t.......s..................tls....:....Pt.......s.............@..._RDATA..\....`t.......s.............@..@.rsrc........pt.......s.............@..@.reloc........t.......s.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\28b06dd0-38bd-4037-96fc-06ceb5da9870.tmp.node

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):140288
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.055411992765344
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:94PTD6FEzMju6bzJKjpEPeTOKvJhEnww+YbRYvPuq:94jQju6b9KilKvJurR8W
                                                                                                                                                                                                                                                                                                        MD5:04BFBFEC8DB966420FE4C7B85EBB506A
                                                                                                                                                                                                                                                                                                        SHA1:939BB742A354A92E1DCD3661A62D69E48030A335
                                                                                                                                                                                                                                                                                                        SHA-256:DA2172CE055FA47D6A0EA1C90654F530ABED33F69A74D52FAB06C4C7653B48FD
                                                                                                                                                                                                                                                                                                        SHA-512:4EA97A9A120ED5BEE8638E0A69561C2159FC3769062D7102167B0E92B4F1A5C002A761BD104282425F6CEE8D0E39DBE7E12AD4E4A38570C3F90F31B65072DD65
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..............C.......C.....C................................"...C...............................................Rich............................PE..d....-!e.........." ...#.>..........XG....................................................`.............................................X.......<....`.......0..$............p..........p...............................@............P..........@....................text...`=.......>.................. ..`.rdata.......P.......B..............@..@.data...............................@....pdata..$....0......................@..@_RDATA..\....P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\Clean_Cookies.zip

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):310
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.9437318546723215
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:5jVl02jROOi/Rjhtl6DqSROOi/tPln12jROO3DRtnk+qSROORZ:5jV7RuJjr8DnRulPlnGR7D7nznR1Z
                                                                                                                                                                                                                                                                                                        MD5:9477B3F15A3FB0E6EE07EF2D895A45B8
                                                                                                                                                                                                                                                                                                        SHA1:EA21E38063317AF160F7531E56F057EFF665F86A
                                                                                                                                                                                                                                                                                                        SHA-256:20AF1F8E1D5B3E710883D12D2F407D01CB1BC35678F3018CE189CA5488CC9917
                                                                                                                                                                                                                                                                                                        SHA-512:19ACDFF04774A28406604A102FC11DD60CCC2DD7634E6E25E42F4B5939BC8D7E4072E124178DEF7B99CA9281D9E3447B2AFDB546DAAE149C7332D9BE216FC1F0
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:PK..........uY................chrome_default_cookies.txt..PK..............PK..........uY................edge_default_cookies.txt..PK..............PK..-.........uY...................... .......chrome_default_cookies.txtPK..-.........uY...................... ...J...edge_default_cookies.txtPK....................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\a6581550-1096-4c7c-b670-a23929eacb81.tmp.node

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):1453056
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.517222544789646
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:24576:HczztZ12vAxqcdzoAyv+liT0eYiYJ869tUb/K:8zztZ12vodwW0T0NZJftm
                                                                                                                                                                                                                                                                                                        MD5:56192831A7F808874207BA593F464415
                                                                                                                                                                                                                                                                                                        SHA1:E0C18C72A62692D856DA1F8988B0BC9C8088D2AA
                                                                                                                                                                                                                                                                                                        SHA-256:6AA8763714AA5199A4065259AF792292C2A7D6A2C381AA27007255421E5C9D8C
                                                                                                                                                                                                                                                                                                        SHA-512:C82AA1EF569C232B4B4F98A3789F2390E5F7BF5CC7E73D199FE23A3F636817EDFDC2FB49CE7F69169C028A9DD5AB9F63E8F64964BB22424FC08DB71E85054A33
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z2..;\Q.;\Q.;\Q.]XP.;\Q.]_P.;\Q.]YPw;\Q.SXP.;\Q.S_P.;\Q.SYP.;\Q.]]P.;\Q.;]Q6;\QcRUP.;\QcR\P.;\QcR.Q.;\QcR^P.;\QRich.;\Q........PE..d....}*`.........." ................T.....................................................`.............................................\.......(....P.......p...............`......P...p............................7..........................@....................text............................... ..`.rdata..&J.......L..................@..@.data...dR.......<..................@....pdata.......p.......:..............@..@.rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\mnjk9j2skp9o.zip

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):304
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.3248014991837365
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6:5je/IS5je/60e/W0WY/5/cVY/amIN/AWSB8lC:5jegsKiDO0NRmYSXN4Ww80
                                                                                                                                                                                                                                                                                                        MD5:0BF4F1DB55842D3A59F6623B32008694
                                                                                                                                                                                                                                                                                                        SHA1:C2A815DBB96D6D8623036846010CEF86E499A2F1
                                                                                                                                                                                                                                                                                                        SHA-256:C7CEDD240D7E140C627FA38A19FE23EE62FCABA7AD980491DA35868544FBDE27
                                                                                                                                                                                                                                                                                                        SHA-512:A538118BFD55B8F898C0935AC0658B98903984CB53377AD1E4AEB367966021EFB6F71DE6F4920EE799CA51F12C4FB85B8CAC619AFA71A27E56FDFE8047C13BAB
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:PK..........uY................Autofill/PK..........uY................Cookies/PK..........uY................Passwords/PK............uY.........................A....Autofill/PK............uY.........................A'...Cookies/PK............uY.........................AM...Passwords/PK..............u.....

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\LICENSE.electron.txt

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):1096
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.13006727705212
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                                                                                                        MD5:4D42118D35941E0F664DDDBD83F633C5
                                                                                                                                                                                                                                                                                                        SHA1:2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
                                                                                                                                                                                                                                                                                                        SHA-256:5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
                                                                                                                                                                                                                                                                                                        SHA-512:3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\LICENSES.chromium.html

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:HTML document, ASCII text
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):8315859
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.706254155756507
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:24576:dbTq6T06T5kJWSIRWnBIl70mfT76y6E65606F/HXpErpem:t4scj
                                                                                                                                                                                                                                                                                                        MD5:8303B3A19888F41062A614CD95B2E2D2
                                                                                                                                                                                                                                                                                                        SHA1:A112EE5559C27B01E3114CF10050531CAB3D98A6
                                                                                                                                                                                                                                                                                                        SHA-256:9C088CAAC76CF5BE69E0397D76FE9397017585CFFDBA327692FF1B3A6C00D68F
                                                                                                                                                                                                                                                                                                        SHA-512:281B2ECC99502A050EE69E31256DEC135E8CB877D1A6BA9F1C975FCFB11C062980EE6061D2368B62F91E392953AE6235DD726A9D98E6EFC1302F7ED713099179
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview: Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\MayitaV16.exe

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):162117120
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.733463680381509
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:1572864:ATmw0ciLNpDPuAvHxJLkY2O6Ea3f9kwZXeT6EivLp1vUAtdjtZn+f4FnIvGaC9dU:zv6E70+Mk
                                                                                                                                                                                                                                                                                                        MD5:DF1D5E605E98A3A533E6AD7E585442E0
                                                                                                                                                                                                                                                                                                        SHA1:2AE91812D80243C2F7B24626FC73E1F7E183D336
                                                                                                                                                                                                                                                                                                        SHA-256:8158D75859986B7F7ED3A6B2A185CDAF95CF6F4476F7C66FED403FDDADE3B01C
                                                                                                                                                                                                                                                                                                        SHA-512:77AFC7AA057FAB4A96283DAE6B85CF4F1F494C3CCA9534AC7199EC07B0D20BE643020E4A86DA672ADD65B0BDD8A486245D4C9215240357AFB5F22E39822A0D33
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 8%
                                                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e..........".................P..........@..........................................`...........................................I.. ....M.h............p...f@..........`........?.......................?.(... !..@.............M.......I......................text............................... ..`.rdata..h.n.......n.................@..@.data....TB...Q.......P.............@....pdata...f@..p...h@...X.............@..@.00cfg..0............ ..............@..@.gxfg...pA.......B..."..............@..@.retplne.....@.......d...................rodata......P.......f.............. ..`.tls.........p.......x..............@...CPADinfo8............|..............@...LZMADEC..............~.............. ..`_RDATA..\...........................@..@malloc_h+........................... ..`.rsrc...............................@..@.reloc.......`......................@..B................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\chrome_100_percent.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):127125
                                                                                                                                                                                                                                                                                                        Entropy (8bit):7.915612661029362
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:vlKzwqCT4wDNzIwL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:vlKzwt4uEgK18Gb0OV8ld0GecQ3f2
                                                                                                                                                                                                                                                                                                        MD5:ACD0FA0A90B43CD1C87A55A991B4FAC3
                                                                                                                                                                                                                                                                                                        SHA1:17B84E8D24DA12501105B87452F86BFA5F9B1B3C
                                                                                                                                                                                                                                                                                                        SHA-256:CCBCA246B9A93FA8D4F01A01345E7537511C590E4A8EFD5777B1596D10923B4B
                                                                                                                                                                                                                                                                                                        SHA-512:3E4C4F31C6C7950D5B886F6A8768077331A8F880D70B905CF7F35F74BE204C63200FF4A88FA236ABCCC72EC0FC102C14F50DD277A30F814F35ADFE5A7AE3B774
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:..............t...#.....:.I...J~p...K~6...L~....M~#...N~....O~`...P~m...Q~....R~....S~I...T~....U~'"..V~.,..^~.7.._~;9..b~v:..c~(<..j~.<..k~.B..l~fH..m~.J..n~.K..o~.L.....M.....N....aP....IS....BV....uY.....]....Pa.....d....h....i...hk....l....m...An....n.....................................K.....x...........4.....m.....D.............................1........................'.....*.....4.....>.....C.....D....hM.....U.....V....>X.....Z....E].....]....a...%c....d....f....h....i....k....l....o...wq....t...7v....y....}....~...m................................3.................g.....6............................k.....-...........3.....9......................H.......................Y.................{.....s....M..............F...................&....y..............\....p....Z.........Z.........g...........................T..................6...............M.................r...........1.................X.................u.......

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\chrome_200_percent.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):177406
                                                                                                                                                                                                                                                                                                        Entropy (8bit):7.939611912805236
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:4DQYaEQN6AJPKNzIwafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/rIM0:4DQYaNN68QEVgx5GMRejnbdZnVE6YopY
                                                                                                                                                                                                                                                                                                        MD5:4610337E3332B7E65B73A6EA738B47DF
                                                                                                                                                                                                                                                                                                        SHA1:8D824C9CF0A84AB902E8069A4DE9BF6C1A9AAF3B
                                                                                                                                                                                                                                                                                                        SHA-256:C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C
                                                                                                                                                                                                                                                                                                        SHA-512:039B50284D28DCD447E0A486A099FA99914D29B543093CCCDA77BBEFDD61F7B7F05BB84B2708AE128C5F2D0C0AB19046D08796D1B5A1CFF395A0689AB25CCB51
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:..............t...#.....:.t...J~....K~....L~....M~....N~....O~....P~.%..Q~.*..R~.-..S~c5..T~.9..U~.A..V~.V..^~Ck.._~.m..b~)o..c~yr..j~#s..k~.}..l~....m~...n~...o~......................................K.....!..................Q..............*........................a.......................,%....H0.....2....E:....(A.....F.....L.....R.....T....QY....:].....f.....i....br....Sv..........C...........).................].....}................................................................................................. ....!....%.....*.....,..........O/...../....y1.....2....l4.....6.....7....A:.....?.....C.....K.....S.....Y....._.....e....Ok.....l.....m.....n.....o.....q.....r.....s.....u....:w..............P............................%.............7................,........G........u.............B........S.........a....%........;.....................l...........T..........R...........6..........).............

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\d3dcompiler_47.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):4916712
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.398049523846958
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                                                                                                                                        MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                                                                                                                                        SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                                                                                                                                        SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                                                                                                                                        SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\ffmpeg.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):2882560
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.699294130576871
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:49152:WdTodIrn9wbFV6Ps2cA7SJ/W1C1fLPzhkE7hjU7gUxGJwDw3lCQTQY/N3lzl3heH:C79fe/CmP6w3lXQYef/3
                                                                                                                                                                                                                                                                                                        MD5:A007299C49FA50AEFF594655859780AE
                                                                                                                                                                                                                                                                                                        SHA1:D202F1F617023763A0E9418878E8ECAC96BE9FD4
                                                                                                                                                                                                                                                                                                        SHA-256:B78F0036621AD1D5833289F2AD509963EF78F1A89A3C7DF0F1370FD2D35A2804
                                                                                                                                                                                                                                                                                                        SHA-512:444C4BAA1E1D941BD04F78184CEC519C6EB53A83FBC3AA3EA30522BFFC9ECDE73EBE7B910C1A37C345429298ADA3C0FFCB3E3849E21B2009487B5CD1A02CB2A9
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ....."#..................................................@B...........`A..........................................*.......*.(.............@...............B..3....).......................).(....R#.@............"*.P............................text....!#......"#................. ..`.rdata..D....@#......&#.............@..@.data.........*.."....*.............@....pdata........@.......*.............@..@.00cfg..8.....A.......+.............@..@.gxfg....,....A.......+.............@..@.retplne......A.......+..................tls..........A.......+.............@..._RDATA..\.....A.......+.............@..@.reloc...3....B..4....+.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\icudtl.dat

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):10544880
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.276833777601164
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:98304:GKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8j:GKPBhORjOhCliXUxiG9Ha93Whla6ZGr4
                                                                                                                                                                                                                                                                                                        MD5:2134E5DBC46FB1C46EAC0FE1AF710EC3
                                                                                                                                                                                                                                                                                                        SHA1:DBECF2D193AE575ABA4217194D4136BD9291D4DB
                                                                                                                                                                                                                                                                                                        SHA-256:EE3C8883EFFD90EDFB0FF5B758C560CBCA25D1598FCB55B80EF67E990DD19D41
                                                                                                                                                                                                                                                                                                        SHA-512:B9B50614D9BAEBF6378E5164D70BE7FE7EF3051CFFF38733FE3C7448C5DE292754BBBB8DA833E26115A185945BE419BE8DD1030FC230ED69F388479853BC0FCB
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .Q....B.......B...#...B.. $...B..p$...B...$...B...%...B..`P...C...P...C...Q..(C......<C.....OC......bC..@...uC.......C..P....C.......C.......C..p....C.. ....C.......C.......D..p... D.....3D..0...FD.....YD.....lD.......D......D..0....D.......D..p....D......D..@....D.......E......E..@...*E.....=E..P...NE......bE.....rE..@....E.......E.......E..P....E.......E......E..@....F.......F.....'F..0...7F..P...JF......aF......qF...G...F.. H...F..`K...F...K...F...L...F...-...F...c...G....'.'G....'.>G..@.'.UG..0.'.oG....'..G...!'..G...!'..G..P&'..G...)'..G..@*'..H..`.(..H...e).7H..0.).VH...)*.xH....*..H....*..H...P+..H...Y+..H...Z+..I...]+. I..`^+.9I.. .+.UI....+.lI....+..I..P.-..I...=...I.......I.......I.. ....J..p....J......-J..p...EJ......ZJ......rJ..`....J..@....J.......J.......J..0....J.......J.......J..0....K..@....K..../.2K...,/.GK..../.\K..

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\libEGL.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):480768
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.335610382348666
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:afuE2DT96QHENooSYBjLkt4sasMHemPwlrX+nZiML7hn:afuE2DbkGoS2jLku/wWUiNn
                                                                                                                                                                                                                                                                                                        MD5:CA5BB0794B7700601E9438283D458665
                                                                                                                                                                                                                                                                                                        SHA1:7FCF090B19820B9450937BE800575C526448B581
                                                                                                                                                                                                                                                                                                        SHA-256:4A8BE3B4D9FE790EFDCE38CFF8F312A2F8276908D6703E0C6C37818E217CF1E3
                                                                                                                                                                                                                                                                                                        SHA-512:36EBAB858FE7E014837548575389E7DF2E86676888E4A9039C736D0F2E6463102E68989B794D949DDB16D9BCCE43CE55737FCF2A4B09B1667BF968A9540E9F32
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ....."..........`.....................................................`A........................................00......F>..(.......x.... ...C..............0....(.......................'..(...@A..@...........pA...............................text....!.......".................. ..`.rdata......@.......&..............@..@.data....L....... ..................@....pdata...C... ...D..................@..@.00cfg..8....p......................@..@.gxfg...`$.......&..................@..@.retplne.............<...................tls....!............>..............@..._RDATA..\............@..............@..@.rsrc...x............B..............@..@.reloc..0............H..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\libGLESv2.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):7626240
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.463446463154237
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:98304:WJTPQhRQ4t2fzqJ3IZ155Rl5F/tpcAgsOMN:Wm2foIzRJosr
                                                                                                                                                                                                                                                                                                        MD5:05B585464F18FE0E3BDDB20527697D66
                                                                                                                                                                                                                                                                                                        SHA1:8BCEC2F0B409AFA9FF054E25F3CE85EB9BD50010
                                                                                                                                                                                                                                                                                                        SHA-256:0BB7C6C08B569C1D2DE90A40E6C142591E160A7C6CB15D21807F3404A48C4287
                                                                                                                                                                                                                                                                                                        SHA-512:F680AB9C3070F443C7359BB3F0C2032F5C58C88C7823E4592E8212CE8815EA5F463C86DF113F5320944C62D3CB4E8D45B9B4DCAADCCC1AC9BF203AE4BB52083C
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ......Z......... .M......................................`u...........`A........................................M.k.8.....l.d....pt.......q.`O............t......wk......................uk.(.....Z.@.............l.....p.k.@....................text....Z.......Z................. ..`.rdata..$.....Z.......Z.............@..@.data.........m..|....m.............@....pdata..`O....q..P....q.............@..@.00cfg..8.....t......Rs.............@..@.gxfg....+....t..,...Ts.............@..@.retplne.....@t.......s..................tls....:....Pt.......s.............@..._RDATA..\....`t.......s.............@..@.rsrc........pt.......s.............@..@.reloc........t.......s.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\af.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):377708
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.4079285675542845
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:ebGJWQdLX/Wi6fR9a5DhZ2FQPnUGSBhjA636Zi2Jyn9Ybt5KXpgmLwSVxJsVxSjf:6GJW2bOi6fRmZ2OPnUThjA636Zi2Jynd
                                                                                                                                                                                                                                                                                                        MD5:7E51349EDC7E6AED122BFA00970FAB80
                                                                                                                                                                                                                                                                                                        SHA1:EB6DF68501ECCE2090E1AF5837B5F15AC3A775EB
                                                                                                                                                                                                                                                                                                        SHA-256:F528E698B164283872F76DF2233A47D7D41E1ABA980CE39F6B078E577FD14C97
                                                                                                                                                                                                                                                                                                        SHA-512:69DA19053EB95EEF7AB2A2D3F52CA765777BDF976E5862E8CEBBAA1D1CE84A7743F50695A3E82A296B2F610475ABB256844B6B9EB7A23A60B4A9FC4EAE40346D
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........E...h.....i.....j.....k.....l.....n."...o.'...p.4...r.:...s.K...t.T...v.i...w.v...y.|...z.....|.....}.....................................................................................-.....>.....E.....N.....g.....p.....{...................................................../.....?.....K.....X.....y...........................................................<.....R.....W.....].....l.....y.....}.....................................................+.....9.....A.....I.....P.....U.....c.....s...............................................%.....J.....d.....m.....y...........................................................+.....2.....5.....6.....B.....L.....V.....].....g.............................O.....^.....k.................................................................".....5.....Q.....z....................................... .....".....%.....(.$...*.D...+.G...,.e........./.....0.....1.....3.....4.....5.....6.D...7.U...8.j...9.y...<.....=.....>.....?.....@.....A.....C.$...D.+.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\am.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):613646
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.894866190630168
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:Jf6uKsr8xSTwVF/gsSP5R9F5AVqruvyP2x30jH8+I:Xr8xLVF4sSP5R9F5AVqWyPS
                                                                                                                                                                                                                                                                                                        MD5:C6EF9C40B48A069B70ED3335B52A9A9C
                                                                                                                                                                                                                                                                                                        SHA1:D4A5FB05C4B493ECBB6FC80689B955C30C5CBBB4
                                                                                                                                                                                                                                                                                                        SHA-256:73A1034BE12ABDA7401EB601819657CD7ADDF011BFD9CE39F115A442BCCBA995
                                                                                                                                                                                                                                                                                                        SHA-512:33C18B698040CD77162EB05658ECA82A08994455865B70D1C08819DFAC68F6DB6B27D7E818260CAA25310FF71CF128239A52C948FDE098E75D1A319F478A9854
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........W...h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...r.a...s.r...t.{...v.....w.....y.....z.....|.....}.........................................................................7.....S.....i.........................................L.....k.....m.....q...................................1.....A.....`.............................".....4.....=.....\.....~...................................5.....Q.....W.....Z.....i.............................K.....z.....................................................8.....G.....`.............................".........................................>.....A.....s.............................@.....G.....J.....K.....W.....`.....|.......................<............................./.....g.....w...............................................3.......................E.....j.....p.....x..................... .....".....%.6...(.c...*.....+.....,.........../.....0.....1.]...3.y...4.....5.....6.K...7.s...8.....9.....;.....<.....=.....>.?...?.I...@.i...A.....C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\ar.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):671212
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.903418230501937
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:2wnA/ktqm99pX8vYUxXrmhkH+95NNb++YTzgpPMgSENIg:XACPfuq5S+L
                                                                                                                                                                                                                                                                                                        MD5:56F6DC44CC50FC98314D0F88FCC2A962
                                                                                                                                                                                                                                                                                                        SHA1:B1740B05C66622B900E19E9F71E0FF1F3488A98E
                                                                                                                                                                                                                                                                                                        SHA-256:7018884D3C60A9C9D727B21545C7DBBCC7B57FA93A16FA97DECA0D35891E3465
                                                                                                                                                                                                                                                                                                        SHA-512:594E38739AF7351A6117B0659B15F4358BD363D42FFC19E9F5035B57E05E879170BBAFE51AECE62C13F2AE17C84EFB2AED2FC19D2EB9DCB95EBD34211D61674E
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........'...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.0...w.=...y.C...z.R...|.X...}.j.....r.....w.................................................................!.....X.....h...................................!.....$.....(.....P.....r.........................................A.....W.....j...............................................i.....................................................).....K.....m.......................".....Y.....c.....k.....r...................................4.....g.......................#.....T.....e...............................................9.....O.....e...........................................................j.................1.....F.....b.............................+.....3.....?.....a....................... .....T............................................. .!...".>...%.r...(.....*.....+.....,.0.....G.../.x...0.....1.....3.....4.....5.&...6.....7.....8.....9.....;.....<.4...=.J...>.....?.....@.....A.....C.....D.....E.....F.Y.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\bg.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):701712
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.660949177773058
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:wQpKqVw2iILlY+dAs1aQUfjoaVV4FH2mFx0x35uKN3CuKb7szmV2Jfu64K+z5jSF:5pKqJi6lY+dAs1aQU7yCx35uK4XQzQIp
                                                                                                                                                                                                                                                                                                        MD5:945DE8A62865092B8100E93EA3E9828D
                                                                                                                                                                                                                                                                                                        SHA1:18D4C83510455CE12A6AC85F9F33AF46B0557E2E
                                                                                                                                                                                                                                                                                                        SHA-256:F0E39893A39CE6133C1B993F1792207830B8670A6EB3185B7E5826D50FEA7BA2
                                                                                                                                                                                                                                                                                                        SHA-512:5F61160FF64B9490A1AD5517D8C1BB81AF77D349541FED5045E7F6E5053B7D79B7E8F114630BFBE4D5AF30258F70A6569462BFA39CCB765F8CA191F82EE04F3F
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........P...h.....i.....j.....k.%...l.0...n.8...o.=...p.J...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.........................................................................F.....h...............................................[.........................................#.....Q.....x...................................[.........................................T...............................................'.....U......................./.....c...............................................>.....s.............................4.....^................. .....9.....V.....l...................................\...............................................&.....B.....S.....v...............................................O.....r...................................0.......................9.....z.......................-.....[............... .....".....%.....(.E...*.q...+.t...,.........../.....0.....1.....3.....4.....5.....6.....7.....8.....9.....;.3...<.G...=._...>.....?.....@.....A.....C.F.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\bn.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):904928
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.27317054663832
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:IGZVieUrnJssYEgp8S7cRySC/bYbkJBbdJ2DB5y0XlRr:7ZVlUrnzYEgp8S7cRySCDY0Bbd255lt
                                                                                                                                                                                                                                                                                                        MD5:8FEB4092426A0C2C167C0674114B014D
                                                                                                                                                                                                                                                                                                        SHA1:6FC9A1076723BFAF5301D8816543A05A82AD654D
                                                                                                                                                                                                                                                                                                        SHA-256:FB0656A687555801EDFB9442B9F3E7F2B009BE1126F901CF4DA82D67AC4AD954
                                                                                                                                                                                                                                                                                                        SHA-512:3DE40BDD18E9E7D3F2ECEEBF7C089E2250CE4D40412A18D718FACBA8F045E68B996978EF8B4D047B21D3424094056D16B5ABB81BD0507F446B805D6B889522A7
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........J...h.....i.....j.....k."...l.-...n.5...o.;...p.H...r.N...s._...t.h...v.}...w.....y.....z.....|.....}.............................................................................................................5....._....................... .....".....&.....N.......................).....R.....n.......................F...................................K.....a...........3.....B.....].........................................?.....x.................@.......................................................................F....._.....q.................}.......................@.....e.............................1.....U.....y...............................................<...........h...................................4.....P.........................................e...........7.....s...........E...................................'... .<...".....%.....(.....*.K...,.N........./.....0.....1.O...3.o...4.....5.....6.....7.....8.4...9.S...;.....<.....=.....>.....?.$...@.Y...A.....C."...D.B.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\ca.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):426865
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.401183228931482
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:+S19cdrijIs3cSlFEYLCJBB43nbhjJSwmrwiwWzMw1dLbpuQ16BtryBBwIle3neq:t39V4GRsMNux1hnW5CptA
                                                                                                                                                                                                                                                                                                        MD5:01ACD6F7A4EA85D8E63099CE1262FBAD
                                                                                                                                                                                                                                                                                                        SHA1:F654870D442938385B99444C2CACD4D6B60D2A0D
                                                                                                                                                                                                                                                                                                        SHA-256:B48D1BAD676F2E718CBE548302127E0B3567913A2835522D6DD90279A6D2A56A
                                                                                                                                                                                                                                                                                                        SHA-512:2BD13ECA1A85C219E24A9DEB5B767FAA5DC7E6B3005D4EB772E3794233ED49CB94C4492538D18ACC98658C01D941E35C6F213C18AC5480DA151C7545EEDEB4AB
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........N...h.....i.....j.....k.!...l.,...n.4...o.9...p.F...r.L...s.]...t.f...v.{...w.....y.....z.....|.....}...............................................................................6.....O.....o.....|.....................................................2.....J.....j.....q...........................................................1.....;.....M.....].......................................................................D.....i.................................................................+.....2.....?.....u.........................................".....5.....F.....b.....e.....}.............................................................................&.....h......................./.....P.....s.....................................................4.....P.....|...............................................:.....F... .Q...".g...%.....(.....*.....+.....,.........../.-...0.2...1.h...3.x...4.....5.....6.....7.....8.....9.(...;.6...<.D...=.R...>.l...?.v...@.....A.....C.....D.....E...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\cs.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):436203
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.843605854598268
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:U4Wm4h8qE2jv7SxUjBA59wjR558YAGKND9Gto8QV:U4WlvE2jjSxqywjR558YAbNDcI
                                                                                                                                                                                                                                                                                                        MD5:A934431D469D19A274243F88BB5AC6FB
                                                                                                                                                                                                                                                                                                        SHA1:146845EDC7442BF8641BC8B6C1A7E2C021FB01EB
                                                                                                                                                                                                                                                                                                        SHA-256:51C36A5ACDAD5930D8D4F1285315E66B2578F27534D37CD40F0625EE99852C51
                                                                                                                                                                                                                                                                                                        SHA-512:562F07151E5392CBFFB6B643C097A08045E9550E56712975D453A2EBAEE0745FBFBA99D69867EEC560D1D58B58DFF4F6035811B9D4F0B1B87547EFA98F94D55D
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:......../...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w.........................................................................................#.....,.....9.....V.....d.........................................!.....?.....L.....X.....d.....o.....................................................".....4.....E.....{.......................................................................8.....O.....d.....{.................................................................H.....Z.....h.....................................................9.....<.....J.....X.....h.....w.................................................................!.....p.......................".....>.....s.....................................................&.....N.....n.........................................+.....5... .=...".N...%.u...(.....*.....+.....,.........../.....0.....1.H...3.V...4.s...5.....6.....7.....8.....9.....<."...=.,...>.A...?.I...@.[...A.....C.....D...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\da.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):396425
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.453683242581375
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:HWjRHz8SRl8o4mmwlGXaJwZnBEb1INv65h5aarXyzOeiphd4CTWwG:H+AoROBE55frxTe
                                                                                                                                                                                                                                                                                                        MD5:BB5252DC6F0F3C01CE3638138BF946C8
                                                                                                                                                                                                                                                                                                        SHA1:BFB584B67C8CA51D94BFF40809410553D54DA1CF
                                                                                                                                                                                                                                                                                                        SHA-256:C93F39D0AB9A2FAB26977AA729261633225879BA6DC5EA8D0CA89814B2DF9FA9
                                                                                                                                                                                                                                                                                                        SHA-512:E411FD3CC5285A6059C3FD80C3421253A4CE06B2D0CD1CD1EFC25E88191A58FED176452D852922137268BE2824E1E162CD4D4A6F8C695A50517A783D15B1C6E7
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........]...h.....i.-...j.9...k.H...l.S...n.[...o.`...p.m...r.s...s.....t.....v.....w.....y.....z.....|.....}.........................................................................C.....Q.....a.....u.....}.....................................................#.....8.....O.....V.....a.....q.....x...........................................................9.....J.....y.......................................................................#.....=.....X.....q.....{.....~.................................................................3.....I.....o............................................................................./.....6.....9.....:.....A.....J.....P.....W.....b.......................!.....\.....r................................................................. .....J....._................................................... .....".....%.0...(.X...*.....+.....,.........../.....0.....1.....3.....4.)...5.A...6.s...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.)...C.F...D.P.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\de.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):424275
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.503242835637318
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:Vn8S0lko9kj+QrKJgWqajUzUd8YI3iSEmhqYf51gHN8OIkCJD:V5oGyQWJgTaKcSEi5h9kCJD
                                                                                                                                                                                                                                                                                                        MD5:ED329B35D10E81F55D611FE8748876F8
                                                                                                                                                                                                                                                                                                        SHA1:0D998732BB4C4D1FAAD5A5BC0A21D6C5672418D3
                                                                                                                                                                                                                                                                                                        SHA-256:6FACD562ADD58C4684EF4A40DE9B63581FEA71C5B83049ED8A2C2A2C929C45CE
                                                                                                                                                                                                                                                                                                        SHA-512:BD713FF78E375FEC3A04AB0C9476C0379F87EFC6D18359C2A4D297303D78381081120C371848C8675F1F16DD4AB7284D81E5BFC9AE11AB33E12F96C12D89E764
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............h.R...i.c...j.o...k.~...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...................'...../.....7.....>.....E.....L.....M.....N.....P........................................................... .....6.....8.....<.....d.....y.....................................................).....M.....`.....f.....o...............................................0.....G.....K.....N.....W.....p...................................@.....M.....W....._.....f.....l.....y...............................................,.....`.................................................................2.....K.....e.....l.....o.....p.....z...................................9...................................2.....;.....M.....W.....d.....i.....n...................................$.....U.....q.....w........................... .....".....%.....(.....*.+...+.....,.L.....].../.s...0.{...1.....3.....4.....5.....6.=...7.Q...8.e...9.s...;.....<.....=.....>.....?.....@.....A.....C.....D.!.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\el.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):769054
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.751354951226556
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:H/58iMx4BquNw2202pgtZSWjZ4LIbsJvaP5A3HKQiEQBR07391qf2utKMaBlS9Wb:Hgx4BquNw2202pgtsWjyLrJvaRA3Htic
                                                                                                                                                                                                                                                                                                        MD5:6922AAA87431699787C1489E89AF17B9
                                                                                                                                                                                                                                                                                                        SHA1:6FB7771C9271CA2EEEBE025A171BFA62DB3527F7
                                                                                                                                                                                                                                                                                                        SHA-256:800545F9134914649DA91B90E7DF65D8208014C3E12F2BE551DFD6722BF84719
                                                                                                                                                                                                                                                                                                        SHA-512:367EF8467631E17E0A71D682F5792A499E8578B6C22AF93D9A919D9E78709EC2501DF9599624F013B43F4C3E9FB825182193116DBEAD01874995D322B7A6E4D6
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........M...h.....i.....j.....k.....l.(...n.0...o.5...p.B...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................P.....w.............................B.....N.....Z...................................+.....x...................................h.....y.............................&.....C.....a.................,.....4.....H.....o...................................!.....M.................8...............................................1....._.....w.................!.....2.....q.................J.....a.........................................,.....O.....|.........................................!.....3.....F.....^.......................,.................<.............................(.....;.....I.......................M.................T.................................../... .B...".e...%.....(.....*.7...+.:...,.X........./.....0.....1.m...3.....4.....5.#...6.....7.....8.....9. ...;.a...<.w...=.....>.....?.....@.....A.B...C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\en-GB.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):344608
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.516692483052514
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:8esz1VquAhWG5J8C4MP9egFXwqfaYnT9Xa5alSeBNeg:8rz1sNZr4M1XwWT05YSxg
                                                                                                                                                                                                                                                                                                        MD5:0DB7F3A3BA228AA7F2457DB1AA58D002
                                                                                                                                                                                                                                                                                                        SHA1:BBF3469CAADFA3D2469DD7E0809352EF21A7476D
                                                                                                                                                                                                                                                                                                        SHA-256:CF5ACA381C888DE8AA6BBD1DCD609E389833CB5AF3F4E8AF5281FFD70CD65D98
                                                                                                                                                                                                                                                                                                        SHA-512:9C46C8D12579BD8C0BE230BBCDB31BDB537D2FEA38000CF700547CA59E3139C18CC7CB3E74053475605132404C4C4591F651D2DAD2CE7F413CCFFD6ACF7139E8
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:..........h.h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w...........................................................................................................3.....;.....E.....c.....t.....v.....z...........................................................+.....:.....T.....g.....k.....q...................................................................................,.....:.....S.....h.....{.......................................................................+.....5.....A.....X.....h.................................................................(.....=.....R.....f.....m.....p.....q.....x..................................................... .....P.....].....h.......................................................................-.....D.....l....................................... .....".....%.....(.....*.....+.....,./.....@.../.N...0.W...1.....3.....4.....5.....6.....7.....8.....9.(...;.9...<.A...=.L...>.a...?.i...@.x...A...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\en-US.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):347111
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.508989875739037
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:xiLqIY2MuZYLMMP9ecGmM8faYdY4K55TiSbn8vMwS:xiLqIp34MM+mM0Y55eSKMwS
                                                                                                                                                                                                                                                                                                        MD5:5E3813E616A101E4A169B05F40879A62
                                                                                                                                                                                                                                                                                                        SHA1:615E4D94F69625DDA81DFAEC7F14E9EE320A2884
                                                                                                                                                                                                                                                                                                        SHA-256:4D207C5C202C19C4DACA3FDDB2AE4F747F943A8FAF86A947EEF580E2F2AEE687
                                                                                                                                                                                                                                                                                                        SHA-512:764A271A9CFB674CCE41EE7AED0AD75F640CE869EFD3C865D1B2D046C9638F4E8D9863A386EBA098F5DCEDD20EA98BAD8BCA158B68EB4BDD606D683F31227594
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:..........:.h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...r.d...s.u...t.~...v.....w.....y.....z.....|.....}.........................................................................6.....C.....R.....b.....i.....r.................................................................#...........>.....E.....Q.....l.....~.................................................................2.....:.....F.....S.....W.....Z.....`.....p...................................................................................:.....A.....P...........................................................'.....5.....H.....K.....\.....l.....|...................................................................................E.....m.....t.......................................................................0.....I.....m......................................................... .....".....%.3...(.J...*.c...+.f...,.........../.....0.....1.....3.....4.....5.....6.J...7.Z...8.o...9.|...;.....<.....=.....>.....?.....@.....A...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\es-419.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):421247
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.378825024438884
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:EqEmmoO5Tkz+v9zjzVdY/tIyN9d8pizkGp2Ioiw5QbdOXV5blUB0GLF90RRIHKx1:EqFmoY9rYChpWq95wLF90oSdc4
                                                                                                                                                                                                                                                                                                        MD5:5321C1E88C5C6FA20BDBC16043C6D0F6
                                                                                                                                                                                                                                                                                                        SHA1:07B35ED8F22EDC77E543F28D36C5E4789E7723F4
                                                                                                                                                                                                                                                                                                        SHA-256:F7CAA691599C852AFB6C2D7B8921E6165418CC4B20D4211A92F69C877DA54592
                                                                                                                                                                                                                                                                                                        SHA-512:121B3547A8AF9E7360774C1BD6850755B849E3F2E2E10287C612CF88FB096EB4CF4EE56B428BA67AEB185F0CB08D34D4FA987C4B0797436EEA53F64358D2B989
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........c...h.(...i.1...j.=...k.L...l.W...n._...o.d...p.q...r.w...s.....t.....v.....w.....y.....z.....|.....}.........................................................................D.....V.....e.....z...........................................................0.....K.....e.....m.....{...............................................".....'...../.....A.....e.....v...........................................................4.....O.....f...............................................%.....8.....G.....Y.....q.....y...................................!.....D.....P.....c.....o...........................................................&.....).....*.....3.....<.....E.....L.....].................4.....<.........................................-.....8.....A.....F....._...................................B.....[.....a.....i.....w............... .....".....%.....(.....*.....+. ...,.>.....d.../.....0.....1.....3.....4.....5.....6.]...7.o...8.....9.....;.....<.....=.....>.....?.....@.....A.3...C.Z...D.d.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\es.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):421381
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.350071187715506
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:LulovTVU/dglXU0+/oIgAClpG+v6Idj+I5Orj7FQoheL66PZqS:LbvTwdglCTupXv6gj+I5OrmohEGS
                                                                                                                                                                                                                                                                                                        MD5:E9FA4CADA447B507878A568F82266353
                                                                                                                                                                                                                                                                                                        SHA1:4A38F9D11E12376E4D13E1EE8C4E0D082D545701
                                                                                                                                                                                                                                                                                                        SHA-256:186C596D8555F8DB77B3495B7AD6B7AF616185CA6C74E5DFB6C39F368E3A12A4
                                                                                                                                                                                                                                                                                                        SHA-512:1E8F97FF3DAAD3D70C992F332D007F3DDB16206E2FF4CFFD3F2C5099DA92A7AD6FB122B48796F5758FE334D9FBF0BBAE5C552414DEBBB60FE5854AAA922E206E
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........Y...h.....i.....j.(...k.7...l.B...n.J...o.O...p.\...r.b...s.s...t.|...v.....w.....y.....z.....|.....}.........................................................................8.....K.....[.....p.....~.....................................................&.....E....._.....g.....u...........................................................'.....9.....L.....].................................................................1.....Q.....{.....................................................+.....<.....T.....\.....m...................................3.....>.....H.....T.....f.............................................................................%...........5.....F.................1.....9.........................................).....4.....@.....E.....]...................................,.....E.....K.....S.....a............... .....".....%.....(.....*.....+.....,.'.....A.../.[...0.b...1.....3.....4.....5.....6.4...7.E...8.Z...9.l...;.}...<.....=.....>.....?.....@.....A.....C./...D.9.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\et.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):380687
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.464870724176939
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:2Mg++J/xRN0JLnrC4HFJbT/RauiQ/G5LjR43f7LQkPQW:2MmJnq7DG5LjQ
                                                                                                                                                                                                                                                                                                        MD5:A94E1775F91EA8622F82AE5AB5BA6765
                                                                                                                                                                                                                                                                                                        SHA1:FF17ACCDD83AC7FCC630E9141E9114DA7DE16FDB
                                                                                                                                                                                                                                                                                                        SHA-256:1606B94AEF97047863481928624214B7E0EC2F1E34EC48A117965B928E009163
                                                                                                                                                                                                                                                                                                        SHA-512:A2575D2BD50494310E8EF9C77D6C1749420DFBE17A91D724984DF025C47601976AF7D971ECAE988C99723D53F240E1A6B3B7650A17F3B845E3DAEEFAAF9FE9B9
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........m...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....:.....l.....|...............................................,.....B.....D.....H.....p.................................................................5.....B.....H.....P.....^.....m.....v.......................................................................-.....F.....Z.....o.......................................................................0.....=.....W.....e.................................................................-.....B.....V.....m.....t.....w.....x...............................................U.....[...............................................$.....).....,.....<.....b.....x.........................................$.....6.....O.....Z... .d...".w...%.....(.....*.....+.....,....... .../.8...0.E...1.n...3.y...4.....5.....6.....7.....8.....9.+...;.>...<.K...=.T...>.g...?.o...@.~...A.....C.....D...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\fa.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):622224
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.029280630090111
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:jje/X9nuyaXgfwHawNUWGOGfStQEvy1zeItDmNtua/1wMTAKzIxRAQiHedNu36XH:mxuyaXgfw6wNUWGOGfStQEvy1zeItDm8
                                                                                                                                                                                                                                                                                                        MD5:DCD3B982A52CDF8510A54830F270E391
                                                                                                                                                                                                                                                                                                        SHA1:3E0802460950512B98CD124FF9F1F53827E3437E
                                                                                                                                                                                                                                                                                                        SHA-256:E70DFA2D5F61AFE202778A3FAF5ED92B8D162C62525DB79D4EC82003D8773FA3
                                                                                                                                                                                                                                                                                                        SHA-512:3D5B7FA1A685FA623EC7183C393E50007912872E22CA37FDC094BADAEFDDEAC018CC043640814A4DF21BB429741DD295AA8719686461AFA362E130B8E1441A12
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............h.|...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.$...}.6.....>.....C.....K.....S.....[.....b.....i.....p.....r.....w...................................7....._.....m.....w............................. .....C.....r.....x...................................G.....b.........................................V.....{.....................................................:.....Y.......................-.....H.....P.....X....._.....i.....z.............................-.....D.....a.............................5.....D.....^.....t........................................./.....L.....S.....V.....g.....x.....................................................u.............................1.....9.....L.....X.....d.......................&.....L.....y...................................I.....\... .o...".....%.....(.....*.*...+.-...,.K.....o.../.....0.....1.....3.....4.-...5.a...6.....7.....8.0...9.I...;.Y...<.k...=.....>.....?.....@.....A.....C.X...D.....E...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\fi.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):389054
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.4272126333674695
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:7Ji6mI/BcM0ohFpxGseSFOE/xaWEkLl5W5ucHiEi18OWUcrOShPGNgX1wA2:7Ji9CBPbpxaS5W5xHiEi18OWUs/2
                                                                                                                                                                                                                                                                                                        MD5:5518B51D4AF7F1B9D686CBEA28B69E71
                                                                                                                                                                                                                                                                                                        SHA1:DF7F70846F059826C792A831E32247B2294C8E52
                                                                                                                                                                                                                                                                                                        SHA-256:8FF1B08727C884D6B7B6C8B0A0B176706109AE7FE06323895E35325742FE5BD1
                                                                                                                                                                                                                                                                                                        SHA-512:B573050585C5E89A65FC45000F48A0F6AABCCD2937F33A0B3FCBD8A8C817BEAA2158F62A83C2CAE6FCFB655F4A4F9A0C2F6505B41A90BC9D8EDE74141EBC3266
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............h.~...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.&...|.,...}.>.....F.....K.....S.....[.....c.....j.....q.....x.....y.....z...........................................................".....].....v.....x.....|.....................................................5.....C.....P.....d.....t.....z.....~..................................................... .....*.....0.....O.....h.....~...........................................................$.....1.....F.....L.....T.....................................................+.....<.....M.....P.....^.....p.............................................................................7.............................*.....=.....f.....u...........................................................3.....V............................................. .....".....%.....(.1...*.Q...+.T...,.r........./.....0.....1.....3.....4.....5.4...6.n...7.....8.....9.....;.....<.....=.....>.....?.!...@.@...A.x...C.....D.....E...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\fil.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):438088
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.195613019166525
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:2zHaVyEDQV5aZrU+5xeuhGjZ3ZmA58Pm+7JATvy8:2zNMdU4XA5Imb
                                                                                                                                                                                                                                                                                                        MD5:3165351C55E3408EAA7B661FA9DC8924
                                                                                                                                                                                                                                                                                                        SHA1:181BEE2A96D2F43D740B865F7E39A1BA06E2CA2B
                                                                                                                                                                                                                                                                                                        SHA-256:2630A9D5912C8EF023154C6A6FB5C56FAF610E1E960AF66ABEF533AF19B90CAA
                                                                                                                                                                                                                                                                                                        SHA-512:3B1944EA3CFCBE98D4CE390EA3A8FF1F6730EB8054E282869308EFE91A9DDCD118290568C1FC83BD80E8951C4E70A451E984C27B400F2BDE8053EA25B9620655
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:..........].h.....i.....j.....k.....l.....n.....o.....p.&...r.,...s.=...t.F...v.[...w.h...y.n...z.}...|.....}...........................................................................................5.....<.....E.....d.....l.....y...................................................../.....E.....O.....^.....................................................".....8.......................................................................%.....J.....d.....~.................................................................+.....h.....q.....}...................................&.....4.....I.....o.....r................................................................. .....*.....5.....>.....O.................(.....0.................................................................,.....R.....l.............................6.....=.....H.....Y............... .....".....%.....(.....*.....+.....,.*.....B.../.W...0.`...1.....3.....4.....5.....6.....7.3...8.O...9.d...;.}...<.....=.....>.....?.....@.....A...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\fr.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):455097
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.3846988377077745
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:FaQ6+Dt6QuagV1Zz+zApZ4MYnYMArDBW5Mx0q20wC7KZL3wyLkCMg1fF5FEs6rYX:B6+cV37a5JB
                                                                                                                                                                                                                                                                                                        MD5:0445700799DE14382201F2B8B840C639
                                                                                                                                                                                                                                                                                                        SHA1:B2D2A03A981E6FF5B45BB29A594739B836F5518D
                                                                                                                                                                                                                                                                                                        SHA-256:9A57603F33CC1BE68973BDD2022B00D9D547727D2D4DC15E91CC05EBC7730965
                                                                                                                                                                                                                                                                                                        SHA-512:423F941EC35126A2015C5BB3BF963C8B4C71BE5EDFB6FC9765764409A562E028C91C952DA9BE8F250B25C82E8FACEC5CADA6A4AE1495479D6B6342A0AF9DDA5F
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........@...h.....i.....j.....k.....l.....n.!...o.&...p.3...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.....................................................................................#.....5.....@.....I.....k.....w.....................................................!...../.....@.....M.....[...............................................&.....2.....n.......................................................................0.....Q.....t.......................................................................X.....f.....p..................................."...../.....>.....V.....Y.....p..................................................................................._.......................(.....=.....R...........................................................".....\.........................................(.....I.....S... ._...".x...%.....(.....*.....+.....,.........../.'...0.5...1.r...3.....4.....5.....6.....7. ...8.8...9.N...;.a...<.o...=.....>.....?.....@.....A.....C.,...D.>.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\gu.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):879149
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.32399215971305
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:Xz2UMY57hmdUoITsKMaWZKerbtsMhmksd4M+0+z20QmuOAl5VpvoxWnhygfZw/gQ:D2UMY57h9w4MSbsp5cLhdKE8
                                                                                                                                                                                                                                                                                                        MD5:7B5F52F72D3A93F76337D5CF3168EBD1
                                                                                                                                                                                                                                                                                                        SHA1:00D444B5A7F73F566E98ABADF867E6BB27433091
                                                                                                                                                                                                                                                                                                        SHA-256:798EA5D88A57D1D78FA518BF35C5098CBEB1453D2CB02EF98CD26CF85D927707
                                                                                                                                                                                                                                                                                                        SHA-512:10C6F4FAAB8CCB930228C1D9302472D0752BE19AF068EC5917249675B40F22AB24C3E29EC3264062826113B966C401046CFF70D91E7E05D8AADCC0B4E07FEC9B
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........N...h.....i.....j.$...k.3...l.>...n.F...o.K...p.X...r.^...s.o...t.x...v.....w.....y.....z.....|.....}.............................................................................................................T.....l.................'.....).....5.....].......................4.....S.....i.............................l.................................................................'.....k.....t.....w.............................a.................;.....[.....n.....v.....}.......................+.....:.....f.......................X.....y...........].....s...................................6.....X.....w...............................................-.....L.....c....................... .....B.................Q.............................3.....?.....K.....}...................................o.............................3.....[... .a...".....%.....(.....*.g...+.j...,.........../.....0.....1.~...3.....4.....5.....6.[...7.....8.....9.....;.Q...<.h...=.....>.....?.....@.....A.D...C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\he.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):544212
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.626369079921645
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:EQ+K7r0rkgrlOUmTU2/C9iyBZ60DAf1X2VeQCap4M52QoLpMzu5tlmd9DnwWHQgZ:/+55Voi
                                                                                                                                                                                                                                                                                                        MD5:93D9261F91BCD80D7F33F87BAD35DDA4
                                                                                                                                                                                                                                                                                                        SHA1:A498434FD2339C5D6465A28D8BABB80607DB1B65
                                                                                                                                                                                                                                                                                                        SHA-256:31661709AB05E2C392A7FAEED5E863B718F6A5713D0D4BBDAB28BC5FB6565458
                                                                                                                                                                                                                                                                                                        SHA-512:F213FF20E45F260174CAA21EAE5A58E73777CD94E4D929326DEEFBEF01759D0200B2A14F427BE1BB270DFCD2C6FB2FCE789E60F668AC89ECF1849D7575302725
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........*...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.'...v.<...w.I...y.O...z.^...|.d...}.v.....~.............................................................................4.....M.....`.....y.....................................................6.....Q.....h.....{.............................'.....<.....a.....t.....|...................................;.....C.....M.....i...............................................E.....o...............................................".....>.....f.....p...................................4.........................................#.....&.....9.....P.....c.....{.................................................................a...........1.....;.............................$.....<.....B.....N....._.....g.............................&.....a.........................................!... .3...".N...%.....(.....*.....+.....,.........../.....0.....1.Y...3.n...4.....5.....6.....7.....8.3...9.G...;.\...<.v...=.....>.....?.....@.....A.D...C.w.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\hi.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):921629
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.309424818801467
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:L+UfSs6ZQZmi1jk34lFOwG8bkFSvf4QAEm5dmGhsYK/GR3TX4kNMdpqdYnLsuFQ8:CUfSsDmilN6O5H5NJ6K
                                                                                                                                                                                                                                                                                                        MD5:B7E4892B2030E4F916364856B6CC470A
                                                                                                                                                                                                                                                                                                        SHA1:B08AD51E98E3B6949F61F0B9251F7281818CD23E
                                                                                                                                                                                                                                                                                                        SHA-256:093119A99F008AB15D0E5B34CD16EC6B4313554E6C3CFFE44502BFCE51470E3E
                                                                                                                                                                                                                                                                                                        SHA-512:CA453025D73228592A4BFE747A3EA08B86327F733032A64CED0FC0C9E2E00B02450F133E691B94BE13A3E69E22B43BCA512E5F77B0E490320F0BF8E65571BB46
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........ ...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.....................................................2.....T.....y.............................".....<...................................).....W.....}.......................*.......................+.....W.....g.....}.............................................../.....k.....t.....w.......................>.................&.....l...............................................\.....n.................7.....T...............................................$.....n.....q............................./.....b.....i.....l.....n.........................................R...................................Z.....z...................................5.................q.................\...................................0... .K...".k...%.....(.....*.2...+.5...,.S........./.....0.....1.p...3.....4.....5.....6._...7.....8.....9.....;.^...<.r...=.....>.....?.....@.....A.;...C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\hr.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):423481
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.516218200944141
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:yL0fCmEZW/FhjNmvgVRTKBOS+/6ocIG0uPXuyAF6Wk6DkYAiKbeM/ogQbn7xjemW:QYCmNLjN31V5v5tE77ORS
                                                                                                                                                                                                                                                                                                        MD5:105472BC766A30BB71F13D86081DE68D
                                                                                                                                                                                                                                                                                                        SHA1:D014103AD930889239EFD92ECFDFCC669312AF6C
                                                                                                                                                                                                                                                                                                        SHA-256:A3A853A049735C7D474191DFF19550A15503ECD20BAFE44938EB12EA60E50B7C
                                                                                                                                                                                                                                                                                                        SHA-512:EE7479D459EFF8EC59206C2269DF4E9FC1CA143E9B94A908EB8A5A1E16180BCC88F0B24D73C387F5853EA0418E737641F23146676232C1A3AC794611F7880F11
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........h...h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....r.....s.....t.....v.....w.....y.....z.....|.....}...........................................%.....,.....-...........0.....Y.....e.....q.................................................................A.....T.....p.....x...........................................................".....*.....8.....G.....X.............................................................................%.....B.....c.......................................................................G.....U.....a.....w.............................................../.....2.....B.....S.....f.....|.................................................................(.....g.............................8.....l.....{.....................................................I.....h................................................... .....".0...%.U...(.r...*.....+.....,.........../.....0.....1.....3.)...4.F...5.d...6.....7.....8.....9.....;.....<.....=.....>.4...?.=...@.N...A.....C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\hu.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):456792
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.643747395444093
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:SGudNK66hRyoSSfLOAYXky1MV5QgsZfGRAxY62E9PSam7EEOEeLvx5gR4RStG2rA:pkP6hRyosAhV5QgsiE4747vx5VL/
                                                                                                                                                                                                                                                                                                        MD5:B338DCB0E672FB7B2910CE2F561A8E38
                                                                                                                                                                                                                                                                                                        SHA1:CF18C82EC89F52753F7258CDB01203FBC49BED99
                                                                                                                                                                                                                                                                                                        SHA-256:BCDF39AA7004984CB6C13AAC655B2E43EFEB387CE7D61964B063D6CF37773F7A
                                                                                                                                                                                                                                                                                                        SHA-512:F95F6A8E36D99680FB3CDB439F09439782BCC325923EC54BDC4AEB8EC85CF31A3A2216E40E2B06C73A2F5E7439D8178D8BECAC72781A6D79808067E8CCF3CAC6
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........6...h.....i.....j.....k.....l.....n.....o.....p.....r.#...s.4...t.=...v.R...w._...y.e...z.t...|.z...}.....................................................................................2.....G.....W.....q.....................................................9.....X.....d.....}...............................................0.....5.....;.....N.....^.....s.....................................................-.....G.....d.....z.......................#.....?.....H.....P.....W.....].....l...............................................(.....Q.....x...........................................................;.....`.....u.....|...............................................1.......................b.....w...........................................................K.....l.......................5.....L.....T....._.....w............... .....".....%.....(.....*.8...+.;...,.Y.....j.../.....0.....1.....3.....4.....5.....6.P...7.k...8.....9.....;.....<.....=.....>.....?.....@.....A.0...C.U...D.b.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\id.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):373931
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.37912097047996
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:5ig8kAijuuv1p4UVWfjDVnjHFsRmP28Jvr5PdhpvtEHSVsEaOq:TfjuCpRgVnjHFCm+8dr5Pdhlq
                                                                                                                                                                                                                                                                                                        MD5:BD9636E9C7DC7BE4C7F53FB0B886BE04
                                                                                                                                                                                                                                                                                                        SHA1:55421D0E8EFCBEF8C3B72E00A623FB65D33C953E
                                                                                                                                                                                                                                                                                                        SHA-256:5761EE7DA9CA163E86E2023829D377A48AF6F59C27F07E820731192051343F40
                                                                                                                                                                                                                                                                                                        SHA-512:7C7E88FFD2B748E93122585B95850DED580E1136DB39386CED9F4DB0090E71394A1F9CEB937262C95969132C26BF6CE1684FBB97B6469ED10414171A2E8CC3A4
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........?...h.....i.....j.....k.....l.....n.....o.$...p.1...r.7...s.H...t.Q...v.f...w.s...y.y...z.....|.....}...........................................................................................,.....3.....;.....R.....Y.....c.....~.................................................................*.....H.....Y.....f.......................................................................,.....9.....=.....@.....E.....Y.....h.....|.................................................................(.....D.....J....._.........................................4.....F.....O.....Z.....p...............................................................................................%.....1....._.........................................A.....K.....W.....^.....f.....m.....t.........................................<.....O.....T.....Z.....g............... .....".....%.....(.....*.....+.....,.!.....1.../.@...0.D...1.x...3.....4.....5.....6.....7.....8.....9.%...;.3...<.<...=.I...>.^...?.f...@.w...A...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\it.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):414290
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.287464735635254
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:9ErNnm7VCctogSrqRrhsO1gRT9TeexAGT96+q2tKLV9fLwUQ2KKU3I8HrmwGWNBJ:eGVi3ZPS8KN1Lj+w5ZzoB
                                                                                                                                                                                                                                                                                                        MD5:7C981A25BE0E02FBA150E17D9669A536
                                                                                                                                                                                                                                                                                                        SHA1:3AF10FEB7CDC7BC091B80173301B1A3D4EF941D4
                                                                                                                                                                                                                                                                                                        SHA-256:EE2D2643AD7A8F97B7A6C070910866436CAE0267A6691A3D8A88ED0948D8AF49
                                                                                                                                                                                                                                                                                                        SHA-512:445EECFA83E7635BC3442937BDF3B9C4A38EF3FBB7F07CA90A1D4222E1A29639F3FDCE12B20E798888823F2D612E5972492B3786D37B256AEC5C1C96CDB96B28
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........R...h.....i.....j.#...k.2...l.=...n.E...o.J...p.W...r.]...s.n...t.w...v.....w.....y.....z.....|.....}........................................................................./.....B.....Q.....j.....u.....~...........................................................=.....D.....T.....b.....n.....{.....................................................5.....i.......................................................................,.....M.....r.......................................................................<.....J.....W.....t...........................................................1.....F.....Y.....q.................................................................(.....s.............................*.....P.....X.....l.....u...............................................1.....L.....}....................................... .....".....%.....(.&...*.B...+.E...,.c.....t.../.....0.....1.....3.....4.....5.,...6.{...7.....8.....9.....;.....<.....=.....>.....?.....@.-...A.[...C.~...D...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\ja.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):505348
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.70215508714318
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:Z41y9KfIBW57kXoT3r0x9pUV6tIz4ZKs24AMNA4oQPkwaIAOen1IUNH7bbeCYX5M:gy8f6+/iSVwm4ZKs2kowP/53/gxVX
                                                                                                                                                                                                                                                                                                        MD5:F47EFAA76F5200A6C0C23C33684D7BAD
                                                                                                                                                                                                                                                                                                        SHA1:9B24F6491A1171D3DFEAE329E1F45AB3E3D9CF22
                                                                                                                                                                                                                                                                                                        SHA-256:5B99D6A11D7B653681B2A2BB616CC1814451AD35C370D178B2EF6650465D4F2A
                                                                                                                                                                                                                                                                                                        SHA-512:67D130A66F03A4D1A0A30576B19FE44FA707CBA764C6DCD355CBE891A2BCC0B25823BA2106E9271E06ADA674F66824A5323B77D4984900516D2A8802AF87960E
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:..........w.h.....i.....j.....k.....l.....m.....o.....p.....v.....w.....y.....z.....|."...}.4.....<.....A.....I.....T.....\.....k.....p.....x.....................................................(...........@.....h.....}...................................-.....W.....x...............................................+.....L.....g.....m.....|.............................9.....?.....Q.....o...............................................I.....y...................................................../.....V.....b.............................U.....................................................'.....<.....h...........................................................Z...........0.....6...................................9.....B.....N.....T.....].....x.............................<............................................. .....".....%.M...(.....*.....+.....,.........../.....0.'...1.l...3.....4.....5.....6.....7.8...8.V...9.t...;.....<.....=.....>.....?.....@.....A.I...C.p...D.....E.....F.....G...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\kn.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):1013161
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.228821100054137
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:VfJ86BOVXCMsEb7ytUGGGHPsj/lEmlPV01tqErthLVGkcVw2VzidmEHXy0r2Slih:VfG7VES7yv54EPh4ow7M5LrUf+w542Fv
                                                                                                                                                                                                                                                                                                        MD5:A603F3D899CCDCD9AF20DCD8F87D0ED8
                                                                                                                                                                                                                                                                                                        SHA1:F476355D6EA5C05B35AD74C08E2EDFE5FF2881AD
                                                                                                                                                                                                                                                                                                        SHA-256:3C11A589AAB0C5D9E5C18E6A95DCE7E613089D3598B8FE54E656A8D97E22A6FD
                                                                                                                                                                                                                                                                                                        SHA-512:F6B008080CAE44D680FAAAB02911F62E21D042C55FC5AF87E719E9BC4102B282E58E67F19F37F60FE8BA99F5B8CFD4E70A61AF9918A9EE8E3D8AE72555D31C15
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........m...h.<...i.M...j.Y...k.h...l.s...n.{...o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................!.....(...../.....6.....7.....8.....=.................=.....}......................./.....A.............................:.......................&.....d.................-.....U.................6.....N.....j.................L.............................4.....C.....F.....d.................4.................e.........................................P.....o...............................................J...........,.....H.....v.................(.....+.....e.......................G.....................................................(...........V...................................H.....`.....................................................x.................z.......................E............... .....".....%.t...(.....*.....+.....,.!.....R.../.....0.....1.;...3.U...4.....5.....6.s...7.....8.....9.<...;.m...<.....=.....>.....?.....@.-...A.....C.....D.#.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\ko.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):425564
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.081749497168224
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:neS2i6I3l956t91zt8OhYJRFJCqj5T718I8MtWq7hUoBAA:efia6JH5D8iAA
                                                                                                                                                                                                                                                                                                        MD5:B83BC27C5BC2BB4D0FF7934DB87E12AD
                                                                                                                                                                                                                                                                                                        SHA1:050F004E82F46053B6566300C9A7B1A6A6E84209
                                                                                                                                                                                                                                                                                                        SHA-256:AB3060E7D16DE4D1536FF6DD4F82939A73388201AD7E2BE15F3AFEE6A5AAE0EF
                                                                                                                                                                                                                                                                                                        SHA-512:B56B211587FE93A254198CA617CDECD8DC01E4561151A53173721665111C4D2440535F5F6B8A5A69A31840EA60124F4AFD2C693D1FC4683FA2CF237C8EDE5F0A
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............h.|...i.....j.....k.....l.....m.....o.....p.....r.....s.....t.....y.....z.....|.....}.......&.....+.....3.....>.....F.....U.....Z.....a.....h.....j.....o...........................................................g.....w.....y.....}...............................................).....H.....U.....h.....|...............................................&.....,.....5.....H.....[.....a.....d.....j.........................................:.....Q.....W....._.....f.....o.....|..................................."...../.....Y.....v...............................................1.....>.....N.....[.....t.....................................................$.......................u.................................................................?.....V...................................#.....).....?.....Q.....^... .a...".k...%.....(.....*.....+.....,.-.....C.../.`...0.l...1.....3.....4.....5.....6.?...7.U...8.l...9.|...;.....<.....=.....>.....?.....@.....A.....C.8...D.H...E.i...F.....G...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\lt.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):457229
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.6340316488356885
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:Ca5OWNr5w0tunX4nkokKgneIVUoCb1DD7U5R3zv9dFaL8tx9e2lJ2I96S2:Ca5JOIpg7e2UoC9c59zv9fx9eoP6S2
                                                                                                                                                                                                                                                                                                        MD5:96602A3F3B59FAA997A4D337889FA02B
                                                                                                                                                                                                                                                                                                        SHA1:94593A270B0D84C006E0959BC136B6C4987DFD3F
                                                                                                                                                                                                                                                                                                        SHA-256:51DB5311DE9DFF41FB4EADDA8BA7D5E492912F72C3754ADAF8E3DE23ABA46F8A
                                                                                                                                                                                                                                                                                                        SHA-512:DD45240494D09AD9A41BE9D4056ED274E78A50DC85E6BFF9438E707A84F65B77EBE522531370DA99E50A6887D6063C29E9728B49DF2B2B3C61362D774797FAC2
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........U...h.....i.....j.)...k.8...l.C...n.K...o.P...p.]...r.c...s.t...t.}...v.....w.....y.....z.....|.....}.........................................................................8.....F.....S.....g.....r.....................................................5.....T.....m.....v...............................................!.....6.....=.....F.....S.....a.....u.....................................................&.....<.....Z.....w.............................5.....>.....F.....M.....X.....j.....................................................-.....T.....m.....{.................................................................H.....O.....R.....S.....].....h.....o.....y.................).....x.............................G.....X.....v...............................................B.....d...............................................)... .>...".N...%.m...(.....*.....+.....,.........../.!...0.$...1.U...3.f...4.....5.....6.....7. ...8.@...9.T...;.b...<.s...=.....>.....?.....@.....A.....C.:.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\lv.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):455871
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.635474464056208
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:GOQDGtu4e+D8NHtVFHTPq7K4vHo4q3sb3755ZanXDEG9Aarl4zxmEA5QXls14:GOQUZ2Gu4vTqw75KEGGmEs14
                                                                                                                                                                                                                                                                                                        MD5:E4F7D9E385CB525E762ECE1AA243E818
                                                                                                                                                                                                                                                                                                        SHA1:689D784379BAC189742B74CD8700C687FEEEDED1
                                                                                                                                                                                                                                                                                                        SHA-256:523D141E59095DA71A41C14AEC8FE9EE667AE4B868E0477A46DD18A80B2007EF
                                                                                                                                                                                                                                                                                                        SHA-512:E4796134048CD12056D746F6B8F76D9EA743C61FEE5993167F607959F11FD3B496429C3E61ED5464551FD1931DE4878AB06F23A3788EE34BB56F53DB25BCB6DF
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........e...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................&.....'.....(.....*.....O.....b.....u.....................................................!.....%.....M.....].....s.....z...............................................!.....2.....8.....>.....Q.....e.....{...........................................................%.....7.....I.....g.....}...........................................................3.....7.....P.........................................+.....<.....O.....d.....v...........................................................".....#.....-.....8.....@.....G.....Y.................-.....8...................................%.....,.....;.....>.....I....._.............................#.....T.....i.....p.....y..................... .....".....%.....(.....*.....+.1...,.O.....r.../.....0.....1.....3.....4.....5.!...6.\...7.|...8.....9.....<.....=.....>.....?.....@.....A.9...C.X...D.e.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\ml.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):1056670
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.265027412218305
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:GoHap3rrLnsoR47/J7nUwmoMmWDcZubSA/doySi3ethK5G/7dxOY3ab:Gj3r0ofwvi3eG5G/7OY3c
                                                                                                                                                                                                                                                                                                        MD5:3B1305ECCA60FB5A7B3224A70398EAD9
                                                                                                                                                                                                                                                                                                        SHA1:04E28FCE93FC57360E9830E2F482028FFC58A0A2
                                                                                                                                                                                                                                                                                                        SHA-256:C10942F5333F0D710DE4D3DEF7AA410C4576FFE476B3EA84AAC736BFB9C40D67
                                                                                                                                                                                                                                                                                                        SHA-512:68FDD944A153C16D18E73DD2AA75593F6AC13B8E87DBFB5BFCCDD982A4F885BD9903C3ED1AF781581CD3C5D42DD2FF21CC780F54FD71AB04A3237D08ED5A1554
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........j...h.6...i.G...j.S...k.b...l.m...n.u...o.z...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................".....).....0.....1.....2.....7.................".....b.....}.......................N...........3.....5.....9.....a.......................M.....{.................@.....n...........!.....e.............................'.......................C.....}.............................H.................=.................P.....~.........................................v.................I.....j.........................................b...................................q.......................b.....i.....l.....n.............................1...........q.....'.....E...........N...........(.....`...................................;.............................Y.....4.............................;.....k... .....".....%.n...(.....*.....+.....,.M........./.....0.....1.}...3.....4.....5.>...6.....7.....8.....9.....;.....<.8...=.X...>.....?.....@.....A.....C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\mr.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):863832
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.294820073892162
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:mNmdqcjlxFxta+oFNkWt0qJASXspXi+zoF5MU9G3GRe3RQR3K5/knxi4nou4AmH1:mgqylx+Pkc0qO8o2D6WA0+te503pueVx
                                                                                                                                                                                                                                                                                                        MD5:25F2B9842E2C4C026E0FC4BC191A6915
                                                                                                                                                                                                                                                                                                        SHA1:7DE7F82BADB2183F1F294B63CA506322F4F2AAFA
                                                                                                                                                                                                                                                                                                        SHA-256:771EB119A20FCC5E742A932A9A8C360A65C90A5FE26AB7633419966BA3E7DB60
                                                                                                                                                                                                                                                                                                        SHA-512:AC6D2EEB439351EEE0CF1784B941F6DD2F4C8C496455479CA76919BF7767CCA48A04BA25FCCDE74751BAA7C90B907B347396235A3CE70F15C1B8E5388E5C6107
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........)...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.%...t.....v.C...w.P...y.V...z.e...|.k...}.}.......................................................................;.....].........................................#...................................+.....^.............................A.......................(.....G.....c.....y.......................]...............................................6.....`.......................N.............................!.....(.....4.....W.....p.......................k.....................................................=.....Z.........................................<.....o.....v.....y.....{.........................................9.................................../.....H.....h.....q.............................$.....x.................Q.............................A.....v......... .....".....%.....(.d...*.....+.....,.........../.A...0.N...1.....3.....4.....5.I...6.....7.....8.3...9.[...;.....<.....=.....>.....?.....@.B...A.v...C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\ms.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):390303
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.258177538585681
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:zCsFFfyrvxoQuXkulRopY/5BI8T5sHAVHMM/k3y:tQxoNlR6K5v5vVsMZ
                                                                                                                                                                                                                                                                                                        MD5:9B3E2F3C49897228D51A324AB625EB45
                                                                                                                                                                                                                                                                                                        SHA1:8F3DAEC46E9A99C3B33E3D0E56C03402CCC52B9D
                                                                                                                                                                                                                                                                                                        SHA-256:61A3DAAE72558662851B49175C402E9FE6FD1B279E7B9028E49506D9444855C5
                                                                                                                                                                                                                                                                                                        SHA-512:409681829A861CD4E53069D54C80315E0C8B97E5DB4CD74985D06238BE434A0F0C387392E3F80916164898AF247D17E8747C6538F08C0EF1C5E92A7D1B14F539
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........c...h.(...i.0...j.<...k.K...l.V...n.^...o.c...p.p...r.v...s.....t.....v.....w.....y.....z.....|.....}................................................................... .....J.....].....q.................................................................<.....R.....r.....{.......................................................................+.....;.....J.....y.............................................................................6.....S.....w.............................................................................:.....S....._.................................................................0.....I.....`.....s.....z.....}.....~.....................................................M.....T.................................................................2.....N.....f.....................................................,.....:... .=...".I...%.u...(.....*.....+.....,.........../.....0.....1.....3.;...4.Z...5.m...6.....7.....8.....9.....;.....<.....=.....>.:...?.B...@.W...A...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\nb.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):382997
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.424185417752492
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:Kf9KG0yIhGHby7Op7f21zg2mKP7s4UzUn5el4nYHOp1k:Kf7xHby7Op7f21vs4kY5el4Jp1k
                                                                                                                                                                                                                                                                                                        MD5:7576C2FA9199A4121BC4A50FF6C439C3
                                                                                                                                                                                                                                                                                                        SHA1:55E3E2E651353E7566ED4DBE082FFC834363752B
                                                                                                                                                                                                                                                                                                        SHA-256:2A3DFC6B41FA50FABED387CB8F05DEBBC530FA191366B30C9CB9EAAE50686BD5
                                                                                                                                                                                                                                                                                                        SHA-512:86C44E43609E6EB61273F23D2242AA3D4A0BFA0EA653A86C8B663FA833283CC85A4356F4DF653E85080F7437B81AE6201A3ECF898A63780B5CA67FAA26D669FE
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........S...h.....i.....j.+...k.:...l.E...n.M...o.R...p._...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................3.....>.....M.....`.....h.....r.....................................................$.....<.....A.....P.....a.....h.....t...........................................................).....\.....o.....v.....{...........................................................).....A.....Z.....e.....i.....q.....x.....~...........................................................5.....X.....n.....w.........................................................................................!.....).....4.....;.....F.....v.......................>.....X.....p...........................................................&.....?.....W................................................... .....".....%. ...(.@...*.c...+.f...,.........../.....0.....1.....3.....4.....5.....6.L...7.c...8.....9.....;.....<.....=.....>.....?.....@.....A.....C.".

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\nl.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):395005
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.3648120313169505
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:9w7EkDj0crV7gSSO5S3HDpaQj3D+qnRVZ5qYx1Gp7KNWaPW:9wYkH04FgSSO5SUO7Z5qYx1Gp7KNrPW
                                                                                                                                                                                                                                                                                                        MD5:BC41967B2FF493E7F151C7721245739D
                                                                                                                                                                                                                                                                                                        SHA1:7606133DDBB58492DBBF02C03A975FB48DA1E26F
                                                                                                                                                                                                                                                                                                        SHA-256:3DBE5569F53D1314DCB1BC99540CF6A0FEA45B6D67576FD0D14C688107892F32
                                                                                                                                                                                                                                                                                                        SHA-512:9E395A3B5BBF64DE3E474C56C4FB39879F107A9DB246632CF6BB4B06160E05A82C0161D6496EDB2BC29FEBB4A8F67CA7EA904167B860FD6DA96636A6711CB593
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........E...h.....i.....j.....k.....l.#...n.+...o.0...p.=...r.C...s.T...t.]...v.r...w.....y.....z.....|.....}...............................................................................$.....4.....E.....N.....W.....r.....z.....................................................'.....7.....I.....V.....c...........................................................!.....`.....u.....z...........................................................+.....G.....f.......................................................................9.....E.....].....v.....................................................2.....F.....Y.....t.................................................................'.....a...................................<.....I.....Y.....a.....j.....n.....r...................................".....O.....d.....m.....x..................... .....".....%.....(.....*.....+.....,.!.....2.../.I...0.S...1.....3.....4.....5.....6.....7.....8.;...9.J...;.Z...<.h...=.v...>.....?.....@.....A.....C.....D...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\pl.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):439993
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.767289703106541
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:nXFDujSoL/7+Xgv3iWSb1vPiCUdcUd3Imhz1QhjAB5cyE447e:XJg3d1Qhw5qe
                                                                                                                                                                                                                                                                                                        MD5:61C093FAC4021062E1838A32D79399C2
                                                                                                                                                                                                                                                                                                        SHA1:84A47537EF58D2507CF7697EA7E1E27B1F812EE8
                                                                                                                                                                                                                                                                                                        SHA-256:58067EC06973F5DD7AFEBBE57BFFCE3A3ED9F8E5093AF8FCEFDB6A65B2B68B22
                                                                                                                                                                                                                                                                                                        SHA-512:475D9D4F27CBC23EFD9ACF75024F993BCF7A8279E658CCBD84C8AC810E1C828DE4DAC4141298865FAF1BB8858A7A88A12D1A21C467E8C656533E364CEFF7E5DC
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........T...h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...r._...s.p...t.y...v.....w.....y.....z.....|.....}.........................................................................6.....E.....S.....h.....q...........................................................3.....M.....S.....g.....|.................................................................).....;.....n.............................................................................2.....N.....i.....{.................................................................+.....6.....V.....c...........................................................(.....7.....M.....d.....{...........................................................T.............................,.....i.....r.....................................................7.....V.....r............................................. .....".)...%.K...(.c...*.....+.....,.........../.....0.....1.....3.,...4.K...5.i...6.....7.....8.....9.....;.....<.....=.....>.....?.$...@.7...A.{...C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\pt-BR.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):415490
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.425893789423815
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:Bmyk1sBD6ytNBXBLw1OGDcpryHF55NJNtYbsRklb2:Bk1EuBX5PJbssRwC
                                                                                                                                                                                                                                                                                                        MD5:A23C805EE4D3D67C811B50826CA25A51
                                                                                                                                                                                                                                                                                                        SHA1:C14FA8B9C7073FE88E188CFA4B34883FACCC2C09
                                                                                                                                                                                                                                                                                                        SHA-256:62BE4FB0BD3B8BE563516BFEA3F0848924BB7AFB0C563D02C1508608A4487E3B
                                                                                                                                                                                                                                                                                                        SHA-512:C478BD2234EEF73AA08085D29B916AD1471576FF213F972C9616757172D0CDEC6E5D6797A1F2635AC17A0BAC34964A298E4AB4336479456CE10330128CD68A53
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........j...h.6...i.G...j.S...k.b...l.m...n.u...o.z...p.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................".....).....0.....1.....2.....7....._.....q.....................................................#.....%.....).....T.....c.....|...................................................../.....F.....P.....X.....h.....y...........................................................%.....:.....H.....Y.....r.................................................................+.....5.....F.....~...............................................).....;.....S.....V.....g.....y.............................................................................=.....y............................. .....H.....R.....i.....p.....z...............................................3.....f....................................... .....".....%.....(.....*.(...+.+...,.I.....Z.../.n...0.w...1.....3.....4.....5.....6.-...7.A...8.Y...9.l...;.|...<.....=.....>.....?.....@.....A.....C.!...D.+.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\pt-PT.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):416968
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.40159614402729
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:Mg2vZhLwJeOMfieJVJJxhUOlxLu3yv5xKqSR0B:z2HLwx18dv5xKqSRW
                                                                                                                                                                                                                                                                                                        MD5:ACFFA29064F40A014BC7FE13E5FF58A9
                                                                                                                                                                                                                                                                                                        SHA1:5A0890C94084075446264469818753F699A3D154
                                                                                                                                                                                                                                                                                                        SHA-256:423E7CCB22D32276320ED72F07186188E095C577DB5BCE7309C8BD589A2A8858
                                                                                                                                                                                                                                                                                                        SHA-512:D4572C81FDD3B7B69D77544F68B23AE0B546158033BE503DBAAB736D3CA1188B18916688234FAE9EA29FA430258B2D2B95A93D0E8B74919A62040B84902D3B6E
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........s...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....C.....D.....I.....r...........................................................&.....(.....,.....W.....f...........................................................!.....9.....C.....K.....\.....n.................................................................%.....3.....D.....b.................................................................#.....+.....<.....t.....~...............................................(.....:.....T.....W.....h.....|.............................................................................N...................................0.....X.....b.....|.....................................................;.....^............................................. .....".....%.....(.3...*.P...+.S...,.q........./.....0.....1.....3.....4.....5.8...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.+...A.a...C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\ro.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):430188
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.460211694476929
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:pqgw46K4aoFt3GgnSYJ0vLi5OU6ois2a/7ulqr:pqg16Ft3GgnSYuvLi5OXo3/5r
                                                                                                                                                                                                                                                                                                        MD5:19CFC7C8F1A2E4A2DE1F9F64475469BC
                                                                                                                                                                                                                                                                                                        SHA1:BF6C4F373C19B03E116D2593C64E1CECA47D79DC
                                                                                                                                                                                                                                                                                                        SHA-256:3E725F7A791AED1FBED57F075CA11CE389A5BD425CCCE3C00537DAD27E5A8DD6
                                                                                                                                                                                                                                                                                                        SHA-512:FF5254E3A3676B8F5E74CBA6661AE43D5739C7363C66CB17F74DCE158DC36CEE103885F055846DD320B932F2E7FBDC831BCEE6293D423FF9B842B68644F633BD
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........L...h.....i.....j.....k.$...l./...n.7...o.<...p.I...r.O...s.`...t.i...v.~...w.....y.....z.....|.....}.........................................................................1.....@.....L.....Z.....e.....p...........................................................<.....E.....^.....n.....y...............................................+.....?.....T.................................................................M.....n...................................#.....+.....2.....8.....G.....Y.....n.....u...............................................T.....b.....t.....................................................,.....@.....G.....J.....K.....W.....c.....p.....y.................).....r.....z.............................9.....S.....d.....l.....r.....x.............................3.....V............................................. .....".....%.<...(.S...*.k...+.n...,.........../.....0.....1.....3.....4.'...5.G...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.&...A._...C.....D...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\ru.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):703434
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.837280329650102
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:y0MhY5eXN2hHO3j/jHwzvMBsWA2kkje8P/XyFGGJFsWPaZuLoUFC8WNcHWajf+6K:y0Cjc5w6pw
                                                                                                                                                                                                                                                                                                        MD5:FC0E2FC09AA9089C5DB75BAB7A0754A7
                                                                                                                                                                                                                                                                                                        SHA1:F3D1E3E1600AE188E801A81B6D233DB9903B82DF
                                                                                                                                                                                                                                                                                                        SHA-256:188B6405CB6C5B7C0B35050278A119C3CE41FB90883B9ADB39FEC15DA0A05550
                                                                                                                                                                                                                                                                                                        SHA-512:377E685D1D171D0A7158B56F356CA33D4493D07EFA58D3C384E272E1B6829933552C69AFF95215AE7D1A0F99616A20790708F5187EA10CFE46BAA2BB522FC18F
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:..........S.h.....i.....j.....k.....l.....n.#...o.(...p.5...r.;...s.L...t.U...v.j...w.w...y.}...z.....|.....}.........................................................................:.....W.....t.........................................E.....l.....n.....r...................................(.....A.....K.............................3.....?.....b.......................+.....5.....F.....[.....v.........................................8.....f.........................................*.....K.....e...................................H.....i.............................7.....t.....w...................................B.....I.....L.....M.....].....q...................................>.....J.................#.....e.........................................6.....t.................:.......................#.....7.....G.....w......... .....".....%.....(.....*.....+.....,.........../.....0.....1.]...3.t...4.....5.....6.N...7.r...8.....9.....;.....<.....=.....>.8...?.G...@.f...A.....C.!...D.2...E.j...F...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\sk.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):443083
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.818419643630632
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:o9fWTbKt/WJWyqiLJcPXPJ5ELALWaQlKDEmLFGR:uMKYkyqiWPXR5ELALWaQlwdLE
                                                                                                                                                                                                                                                                                                        MD5:793C442420F27D54410CDB8D8ECCE5FF
                                                                                                                                                                                                                                                                                                        SHA1:8995E9E29DBAAA737777E9C9449B67CA4C5B4066
                                                                                                                                                                                                                                                                                                        SHA-256:5A9D6B77CA43C8ED344416D854C2D945D8613E6C7936445D6FE35E410C7190BB
                                                                                                                                                                                                                                                                                                        SHA-512:291E3D2300C973966D85E15A1B270BA05C83696271A7C7D4063B91097A942590C9797A4D22DFBE154564B779DAC92FD12DB0D5B63F5F0406F818B956B126E7E9
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........U...h.....i. ...j.,...k.;...l.F...n.N...o.S...p.`...r.f...s.w...t.....v.....w.....y.....z.....|.....}.........................................................................A.....U.....].....o.....z.....................................................9.....R.....q.....w...............................................!.....0.....6.....>.....N....._.....s.....................................................$.....:.....L.....h.......................................................................".....=.....|...............................................*.....9.....a.....d.....v...................................................................................d.......................t.........................................%.....0.....9.....P.....x.............................U.....r.....z........................... .....".....%.....(.....*.6...+.9...,.W.....h.../.....0.....1.....3.....4.....5.....6.D...7.Y...8.p...9.....;.....<.....=.....>.....?.....@.....A.(...C.I...D.T...E.t.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\sl.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):427793
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.485228938958345
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:iyCex+3QRB21BPDwY5omcAVOlJgi/fzxzqg:iThgkDwY5omc0i/fzxt
                                                                                                                                                                                                                                                                                                        MD5:4D9D56EF0B176E7F7AA14270E964EC77
                                                                                                                                                                                                                                                                                                        SHA1:515AAC37E4F25CA50BD52EA73889B70B1E79863D
                                                                                                                                                                                                                                                                                                        SHA-256:6BA684A8F06F7EB175955B15D30C7162D92C7E7C48864DFB853238263E1BE8C7
                                                                                                                                                                                                                                                                                                        SHA-512:740ADBB7D8B039F98E187F45A1A87D0354136FB48B75262E508F720BFCBEB2746F04D31A57DCCD50E37DDB5A1B7C0AD79A01CAC6BA5FB98A9AF272AD99FCB169
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........A...h.....i.....j.....k.....l.....n.!...o.&...p.3...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.....................................................................................*.....:.....B.....R.....y...............................................,.....D.....N.....X.....b.....m.....{.................................................................M.....c.....h.....o...........................................................%.....C.....d.................................................................3.....=.....L.....c.....v.....................................................-.....@.....P.....e.....|.................................................................Y.............................2.....m.....z.....................................................2.....H.....o............................................. .....".....%.....(.P...*.t...+.w...,.........../.....0.....1.....3. ...4.<...5.Q...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.,...A.....C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\sr.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):660184
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.762088583435569
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:FqLaALUKEuNI0I4Ki1pg82ATs+Hc549x4moW037LJzk/k/N:FWFLrSqJc5Axjw
                                                                                                                                                                                                                                                                                                        MD5:CF160983A86B51EC42845F4E60AC9123
                                                                                                                                                                                                                                                                                                        SHA1:4D3BD86A7EF1EAADB8BEC0B79ECC6C05B4273A48
                                                                                                                                                                                                                                                                                                        SHA-256:EF07512FB337005BB66696C69722A0D65BFB749B9D2F763F5B2FF2885CB247A4
                                                                                                                                                                                                                                                                                                        SHA-512:B909FC3614C3250856D2C502CBFED5EB6E398140B801669BF92427E7E8A5939B14052B9ABF2C94749F1AEA61946FF66BE4978C68064196458733BCFF0A963FFA
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........e...h.,...i.=...j.I...k.X...l.c...n.k...o.p...p.}...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................&.....'.....(.....*.....y............................. .....b.........................................?.....c.........................................?.....V.....o...................................3.....R...................................'.....1.....A.....M.....l.............................J.....................................................4.....@.....c.............................-.....l...................................P.....S.....n.....................................................%.....1.....J.....Y.....o.......................%.................".....j...............................................c.......................D...................................,.....A... .U...".|...%.....(.....*.....+.....,.<.....d.../.....0.....1.....3.....4.N...5.....6.....7.....8.>...9.r...;.....<.....=.....>.....?.....@.....A.....C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\sv.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):385358
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.543864706629343
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:M4pIcHsEAjiwshcB7xopq/4LLXru9M9SOxDE/xUDvZv5pB5mEgb7:BpIcsV9Bxq5/5mz
                                                                                                                                                                                                                                                                                                        MD5:BBE0785C5F9591E8A1E7C4830FE949D6
                                                                                                                                                                                                                                                                                                        SHA1:DA4F3286079D50E1C04E923529E03E7D334C7FFF
                                                                                                                                                                                                                                                                                                        SHA-256:0AD84F6F95FD7505862278A7C1C92D00A7E7DD4A765569E9C3086F55C1D7059D
                                                                                                                                                                                                                                                                                                        SHA-512:38BAB6F3A6C9395D3B57E63168045AD2E8188B2F04751A15253E7226EC3043C9678A77BE1EB27A3B2E751934A024F3FFC89FFFD9F1E229E19638BE318B53E961
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........0...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.*...t.3...v.H...w.U...y.[...z.j...|.p...}...........................................................................................!.....).....2.....M.....U.....`...........................................................&.....-.....:.....c.....t.........................................................../.....;.....C.....U.....e.....i.....s.....z...................................%.....H.....S.....Y.....a.....h.....n.....{.....................................................).....R.....q.....y.................................................................$.....+.........../.....7.....?.....J.....R.....].................".....).....u.................................................................'.....?.....k...............................................".....*... ./...".9...%.[...(.x...*.....+.....,.........../.....0.....1.....3.)...4.P...5.e...6.....7.....8.....9.....;.....<.....=.....>.....?.....@.%...A.Q...C.p.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\sw.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):404454
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.342474055533773
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:iehLwLk65vqimUwbQuBndO8gJGgnATm5A1vZcsToe4t2ht:isLwZP5Ar
                                                                                                                                                                                                                                                                                                        MD5:EE8DA42FFE40FBB916C56390E2CD99E8
                                                                                                                                                                                                                                                                                                        SHA1:6D824F56AFE6B3605A881D2C26E69A46E6675347
                                                                                                                                                                                                                                                                                                        SHA-256:192E248C7AC4644F8712CF5032DA1C6063D70662216CCF084205F902253AA827
                                                                                                                                                                                                                                                                                                        SHA-512:7BEFE72B073000BC35A31323D666FD51D105A188D59C4A85D76EE72B6C8C83A39A1BEB935C1079DEF8E3FFA8C4BF6044CF4F3BEF0F1C850C789B57E1144FF714
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........Y...h.....i.....j.+...k.:...l.E...n.M...o.R...p._...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................3.....E.....U.....i.....u...........................................................+.....H.....N.....Z.....m.....z.....................................................$.....8.....E.....p.......................................................................8.....W.....{................................................................. .....[.....m.....{...................................(.....4.....K.....x.....{.........................................................................................+.....\...................................+.....P.....Z.....r.....x...............................................-.....L............................................. .....".....%.....(.7...*.S...+.V...,.t........./.....0.....1.....3.....4.....5.1...6.i...7.....8.....9.....;.....<.....=.....>.....?.....@.....A.9.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\ta.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):1043822
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.043942262405797
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:LXNxfybLQ4iFd2n1E+1lhfi5yzntRMcA2i:rffyblEd21Z13i5yzMcA2i
                                                                                                                                                                                                                                                                                                        MD5:A8BEAB6896018A6D37F9B2E5BDD7A78C
                                                                                                                                                                                                                                                                                                        SHA1:64310684247219A14AC3AC3B4C8EBAA602C5F03A
                                                                                                                                                                                                                                                                                                        SHA-256:C68B708BA61B3EEAB5AE81D9D85D6E9F92E416ECFAE92E8DE9965608732384DF
                                                                                                                                                                                                                                                                                                        SHA-512:73B0A31235BF4B7C5AD673F08717F3B4F03BCDF2A91440EE7228AA78C2D15DD2AED32498E23DED78EC35BC731DBE16B6A1C236A170F2A84123A464857686C7B5
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........(...h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.#...v.8...w.E...y.K...z.Z...|.`...}.r.....z.................................................................M.....{.............................v.......................n.....p.....t.................E.....c.......................;.......................0.....m...............................................$.....`...................................0.....y.................9.............................!.....(.....F.....n.......................3.............................F...........;.....`.......................7.....:.....n.................$.....Z.....................................................E.....#.......................Q.................c.............................#...../.....s.............................B.................*.....?.....d............... .....".....%.}...(.....*.O...+.R...,.p........./.....0.....1.u...3.....4.....5.....6.....7.]...8.....9.....;.'...<.G...=.j...>.....?.....@.....A.9...C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\te.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):965192
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.296319027025746
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:zqfk4UYABx3p1F9SviTlw2cTgCNFO9gr/p54JkQJgw4taJCb8+58XfX0Dxq9OyUn:eM4U4lp5WMfD
                                                                                                                                                                                                                                                                                                        MD5:02415DED02CC7AC25E8F8D0E83365061
                                                                                                                                                                                                                                                                                                        SHA1:5A25BF63EC97DBEB37E64AB3825CBBCE6326A5CF
                                                                                                                                                                                                                                                                                                        SHA-256:97024F0CFAC78E0C738E771BEEA1E35F5A8EB2B132B3043B59CE4ECD6C153523
                                                                                                                                                                                                                                                                                                        SHA-512:54E658C6D432B29B031BE278E5B4396AC14B0F85E1F772A0A76C0431D4CBE2370FF2898077837688E2FB9700DB1EAB7A19E4E350A280A2FFAD8176D861D93E45
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........m...h.<...i.V...j.b...k.q...l.|...n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................".....*.....1.....8.....?.....@.....A.....F.................1.....n...........................................................4.....z.......................P.....r.................*.....t.................=....._.......................g.......................1.....{.............................J.................j...........2.....g.........................................\.....q.................@.....[.................b.............................W...................................F...............................................@.....g.....t..........._...................................%.............................5.....J.....Y.................f...........D...........2.............................I.....p... .....".....%.....(.e...*.....+.....,.........../.b...0.....1.....3.:...4.....5.....6.C...7.....8.....9.....;.E...<.b...=.....>.....?.....@.....A.N.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\th.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):812017
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.341302348376344
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:z0O3mMkgs3s5UW4HLRflsjj8sKGs1loIG0EeuLADh7Kle9dPu753ohP09XAyFHyW:Y69K5V5q
                                                                                                                                                                                                                                                                                                        MD5:293AD7C20C22D744E4DB0FB001EC45BB
                                                                                                                                                                                                                                                                                                        SHA1:486C9E0732306A45ACEB633DA2B3DED281197620
                                                                                                                                                                                                                                                                                                        SHA-256:D67D68F24D3347E244A7E8C3B63D47F18FCF37258256F48DAD785CF98BB560FA
                                                                                                                                                                                                                                                                                                        SHA-512:AC2B2DD82095925B3229958E89DCF5283BDCE0273734A0C338F5A1AA8B014644806CA517F0FC2003669910E58FEDF9C2CA7A009FA3F53D58C07BC5E9191F2E2F
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:..........w.h.....i.....j.....k.....l.....o.....p.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....h.....p.....u.....}...............................................2.............................,.....;...................................$.....].....o.............................A.....`.....~.............................b.................h.....................................................N.....{.......................J.....}...............................................0.....N.....x.................&.....}.................I.....g...................................*.....K.....h.....................................................?...........T.................r.................n.........................................=.......................G.................6.....?.....T..................... .....".....%.@...(.....*.....+.....,.........../.V...0.i...1.....3.....4.W...5.....6.*...7.K...8.....9.....;.....<.....=.....>.Y...?.....@.....A.....C.!...D.=...E.p.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\tr.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):411446
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.612902230569552
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:TaT6Tj4rfG2a4l1kKJtkOq/7V56sA7WGgeh5X/0+gi1ZavXmAQwiBTVGI:2w0u27leaoy5775X/7
                                                                                                                                                                                                                                                                                                        MD5:9F24F44CAC0997E1D0A6A419520F3BFE
                                                                                                                                                                                                                                                                                                        SHA1:EDB61859CBB5D77C666AAC98379D4155188F4FF5
                                                                                                                                                                                                                                                                                                        SHA-256:3AFF7DCBFB1A244CC29B290376B52CFB3E1F844C98FACAFEA17B4A45CE064B8A
                                                                                                                                                                                                                                                                                                        SHA-512:65FBE2D7FEA37DB59B805D031F6AE85D628A51B254E76E8C2B4EF4B5153527B7E2412ED6A0961D174B8A5581B521B0436160FE5ED252F78303BCFDE815733D81
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........}...h.\...i.m...j.w...k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.....}.......".....'...../.....7.....?.....F.....M.....T.....U.....V.....X...........................................................L.....f.....h.....l.....................................................4.....I.....U.....x...........................................................&.....3.....H.....J.....M.....T.....k...........................................................".....).....>.....R.....u.........................................-.....P....._.....k.....v.............................................................................#.....,.....3.....>.....F.....U.......................!.....i.....~...........................................................3.....R...............................................*.....A.....G... .R...".g...%.....(.....*.....+.....,.........../.....0.....1.T...3.a...4.w...5.....6.....7.....8.....9.,...;.<...<.G...=.T...>.g...?.p...@.~...A.....C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\uk.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):705044
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.868695926663652
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:FkzOqMnty/KiZswU1nbx05kB3IjUUmEg5KuoLNiXElqnOyh:muGN35EEK
                                                                                                                                                                                                                                                                                                        MD5:E4C4E3700469704B936460CA1A90FCC0
                                                                                                                                                                                                                                                                                                        SHA1:E809990FC07A1D39FE623046382699E648E343C0
                                                                                                                                                                                                                                                                                                        SHA-256:29AF2ABC75A35BB9E3F9BC6E2904228BA651EA4E0CE8E9C7A2D7E272374B9EBB
                                                                                                                                                                                                                                                                                                        SHA-512:68E33F471C5BF2D4ED9CB00ACE3E094EF102A5F1566A6E2C8A3007EF7FBD8A24C36EB36B08745F3608E70940444E9FC7A36FABE1A9945D1F00B4F3F28C7BDAF6
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............h.....i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.,...|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~...................................!.....K.....d.....m.............................P.....R.....V.....~...................................%.....F.........................................1.....S.....y.............................!.....8.....Q.....[.....k.....{.............................A.....n.........................................(.....H.....l.....x.......................&.....=.........................................A.....D.....i.............................'...........1.....2.....B.....T.....f.....y.............................+.................$.....~...................................$.....R.......................<.....w.............................E.....u......... .....".....%.....(.....*.{...+.~...,.........../.....0. ...1.....3.....4.....5.....6.Z...7.}...8.....9.....;.....<.....=.....>.I...?.X...@.y...A.....C.1...D.J.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\ur.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):617160
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.143464180285778
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:bXldbsPI8PzGSEHybOAXsA5yzTExbWW7mQYrjuUco/9NjjFpvhl:rLsK8t5bWx
                                                                                                                                                                                                                                                                                                        MD5:D7EC7D551DEE1E1EF11BE3E2820052F9
                                                                                                                                                                                                                                                                                                        SHA1:D7F2D35841883103C2773FC093A9A706B2FE5D36
                                                                                                                                                                                                                                                                                                        SHA-256:05E45371159075048DB688564B6BC707E0891303C40F490C3DB428B0EDD36102
                                                                                                                                                                                                                                                                                                        SHA-512:92E2D32FC106812E08163A26F202A5D0E7EB7028A871F3BC6CBC05EE6C7CE287032179322B19E396308968515BF214534A38D93AFC259A780AD7BA8432FAB56A
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........S...h.....i.....j.....k.+...l.6...n.>...o.C...p.P...r.V...s.g...t.p...v.....w.....y.....z.....|.....}.........................................................................v...............................................$.....f...............................................6.....].....j.............................=.....d.....n..................................._.....i.....|.........................................+.....M.....{.......................:.....I.....Q.....X.....l...................................S.....f.......................+.....[.....j...............................................$.....B.....`...........................................................Z...........3.....H.............................(.....D.....J.....X.....l.....r.......................e.......................2.....>.....S.....l............... .....".....%.....(.'...*.T...+.W...,.u........./.....0.....1. ...3.:...4.g...5.....6.....7.!...8.\...9.u...;.....<.....=.....>.....?.....@.....A.&...C.`.

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\vi.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):488307
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.797698606019311
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12288:JqiJKHugsHBM0P5ZwSQ3cXzIJ1758/UIi0+UG3Lzi8Tal:eugsHe0PTwSmezE5Iti0+UKfi8Tal
                                                                                                                                                                                                                                                                                                        MD5:9274866D7C6314F43DD63ED293293E25
                                                                                                                                                                                                                                                                                                        SHA1:4AF0E6EC1BCB99588810A9FB69C1DC2BBAD892FC
                                                                                                                                                                                                                                                                                                        SHA-256:DCBDC6D9E11DD10FC1364C10BE5438CE2697F61EC5F32997C43B87238087C4E3
                                                                                                                                                                                                                                                                                                        SHA-512:3C8C9E9960A49469AF83CAE31790A03E41846163C14D3DAE45FD92A1A412C82075BDEF3317BACA02399EB53DE0F9164C0A9A17B7CD63E0FA61C3E4617393C42E
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............h.j...i.....j.....k.....l.....n.....o.....p.....r.....s.....t.....v.....w.....y.....z.....|.!...}.3.....;.....@.....H.....P.....X....._.....f.....m.....n.....o.....q...............................................(.....2.....Y.....x.....z.....~................................... .....+.....D.....t...........................................................5.....L.....V.....a.....r...........................................................T.....q.................................................................o...................................<.....P.....[.....i.....|.........................................#.....:.....A.....D.....E.....N.....W.....c.....m.......................4.....C.....................................................2.....=....._.............................4.....i....................................... .....".....%.....(.E...*.j...+.m...,.........../.....0.....1.....3.....4.*...5.?...6.y...7.....8.....9.....;.....<.....=.....>.....?.'...@.I...A.u...C...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\zh-CN.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):354098
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.681132543457813
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:ALU9jcaZx79+vKKS/+kTme5zBNCJ7AAmlv:nAaZ+vKKS/ye5zBNCJ7Y
                                                                                                                                                                                                                                                                                                        MD5:9D4F54EB5A12CF4C2F34F5F538DFF90B
                                                                                                                                                                                                                                                                                                        SHA1:C31B892CE78C733BDE0571B6236170103CC9FE7A
                                                                                                                                                                                                                                                                                                        SHA-256:58B934A09858F037F1966A495E73D44416180AFCDEBFAEFCEE1F5E3377DE63F7
                                                                                                                                                                                                                                                                                                        SHA-512:46BF6099C50F7959A6F0800EC679B61A78EFABE87985CAD8DC0D7D0006470A9C61E659BDE0258DA6CF7ED6104749A157F5AD133F324479C3460A19FC14E31C37
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:..........>.h.....i.....j.....k.(...l./...m.7...o.=...p.B...r.H...s.Y...t.b...v.w...w.....|.....}...............................................................................'.....3.....E.....K.....^.....u.....{.....................................................%.....1.....I.....U.....a.................................................................$.....3.....9.....B.....T.....f.....l.....r.....x...............................................)...../.....7.....>.....J.....V.....b.....}...............................................=.....[.....j.....p.........................................................................................7.....@.....F.....P.....Z.............................D.....V.....h.................................................................%.....7.....`............................................. .....".....%.....(."...*.7...+.:...,.g.....|.../.....0.....1.....3.....4.....5.....6.G...7.\...8.q...9.}...;.....<.....=.....>.....?.....@.....A.I...C.p...D...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\locales\zh-TW.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):350092
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.694428887930931
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:gTRIoLBHxLFJkrCU28LulyMD94qz5MHzC5M8Z/9ybT1:ga4BRSxBMD94qz5MHzby/o
                                                                                                                                                                                                                                                                                                        MD5:8F67A9F38AD36D7D4A6B48E63852208D
                                                                                                                                                                                                                                                                                                        SHA1:F087C85C51BDBDEF5998CFC3790835DA95DA982A
                                                                                                                                                                                                                                                                                                        SHA-256:92F26E692DC1309558F90278425A7E83E56974B6AF84DBD8CC90324785EE71CA
                                                                                                                                                                                                                                                                                                        SHA-512:623034BBDFDF5D331DE78B630F403AEB9CEF27B1827E0D29EC66AD69310F56C7DB96C6775DF0E749F8112A4A8E75754BCF987903D415FC7AE360E3C39E6E18E0
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:..........\.h.....i.....j.....k.....l.....n.....o.....p.....r.....s.-...t.6...v.K...w.X...y.^...z.m...|.s...}..................................................................................... .....8.....N.....Z.....m...........................................................!.....*.....6.....S.....`.....l.....~.......................................................................#.....)...../.....5.....M.....\.....k.....}.............................................................................'.....T.....`.....l.....................................................,...../.....;.....M....._.....s.............................................................................I.....v.....|...............................................!.....'.....-.....?.....i.....................................................$.....8.....A... .M..."._...%.z...(.....*.....+.....,.........../.....0.....1.@...3.Q...4.i...5.....6.....7.....8.....9.....;.....<.....=.-...>.F...?.P...@.e...A.....C.....D...

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\resources.pak

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):5245561
                                                                                                                                                                                                                                                                                                        Entropy (8bit):7.99547773238381
                                                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                                                        SSDEEP:98304:9LYsbEcnNWz49PDq2Awkmqmcph1Dd42cjrwrbHw4o0DPelwG3RC:90WcMButpphpd4jkrU4oeelrRC
                                                                                                                                                                                                                                                                                                        MD5:31C7D4B11AD95DFE539DD098E0FAB736
                                                                                                                                                                                                                                                                                                        SHA1:5418682D939CE8485ECC9125B872C14FFEC662C2
                                                                                                                                                                                                                                                                                                        SHA-256:A251019EB08F1E695E935D224544BDA37C5AE092BA68A89FA1FE3BD19BDE4F5C
                                                                                                                                                                                                                                                                                                        SHA-512:F868A4AFA4E0D5C561873D2A728E267F98DA2DF3FB90966E5736D496B6A24E71769A02B0346B27B7DCCE11CBE07248E309F50A89977DC8E5BBC06D6CC31BF738
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:............f.......P'....$*.....-...43@...4.H...4XK...4i]...4.f...4.m...4?p...4.v...4.x...4.z...4.~...4....4.....4?....4.....4....4.....4=....4z....4a....4....4....4.....4.....4.....43....4.....4.....4J....4J....4.....4.....4#....4j....4J....5.....5....v5.:..w5.;..x5.<..y5.>..z5a?...5.?...5.D...5.E...5fJ...5.O...5.V...5.f...5.w...5.x...5.|..n<(...x<....y<....z<....{<....|<....<-....<t....<:....<1....<....V@....W@....X@z...Y@f...Z@....[@4...\@Q...]@....^@...._@jh..`@....<A ...=A.....P.~...Pg....PZ....P.....P.....Pv....P.....P5....Q.....QH....Q.....Q.....Q.....Q]....QC....Q.....Q.....QY....Q.....Qx....Q;!...Q.'...QH....Q.1..,Q.F..-QuL...QNN../Q.P..0Q.U..1Q0i..2Q.j..3Q.k..4QGm..5Q.o..6Q.r..7Q.t..8QGw..9Q#x..:Q.z..;Qj...<Q'...=Q~...>Q....?Q ....R....Rw....}.....}. ...}B`...}.a...}.h...}.i...}.j...}.o...}?....}{&...}(/...}.6...}.;...}i=...}.B...}.G...~vO...~>e...~wq...~_u...~.}...~.~..!~...."~....#~(...$~...&~ ...'~....(~$...)~Y...*~.$..+~.5..,~_7..-~.8...~|;../~.<..0~.=..1~.A..2~.I

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\resources\app.asar

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):30007596
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.344368993479669
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:196608:h2zpdmQjwvrU9WMcEKeW1G5psKI4ne1JpgjrnqdJUeo88H88D888HjtkEyBOBOB5:h2zAAEEKeeKIYeZ+udC
                                                                                                                                                                                                                                                                                                        MD5:E9F7BE98ED162DB69C5DCD67BE7BB8CF
                                                                                                                                                                                                                                                                                                        SHA1:1AA435DBE085E871938B0269F0F86A247F865E57
                                                                                                                                                                                                                                                                                                        SHA-256:F1ECCE95B8A3516B001039D5601404FA99BA0221F0CA4C9553C4055F9B6036A3
                                                                                                                                                                                                                                                                                                        SHA-512:AE1B5DA3BF25B2F9D22DC96C05E0743AC58E479C3C5DEE234FDAAD923FE6132767D95574E137267B446CAF6686294C232BADE2EF28F103D7A0A598F139630E21
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:....H'..D'..?'..{"files":{"6e987b9559e72c30.js":{"size":2801804,"integrity":{"algorithm":"SHA256","hash":"07c53ff8f85b5ed8c7aa13ef2f79ffc6b5513ccc369f6664db078f0ac9124ba4","blockSize":4194304,"blocks":["07c53ff8f85b5ed8c7aa13ef2f79ffc6b5513ccc369f6664db078f0ac9124ba4"]},"offset":"0"},"package.json":{"size":767,"integrity":{"algorithm":"SHA256","hash":"18b0064d387a571f0b5cbd543c87a7929eb1878b3beb649198072521058c6191","blockSize":4194304,"blocks":["18b0064d387a571f0b5cbd543c87a7929eb1878b3beb649198072521058c6191"]},"offset":"2801804"},"node_modules":{"files":{"@isaacs":{"files":{"cliui":{"files":{"LICENSE.txt":{"size":731,"integrity":{"algorithm":"SHA256","hash":"2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149","blockSize":4194304,"blocks":["2dc0465729366c3a7890dfa9e972a1ba7048a26c02116fb8b419a6a1ac110149"]},"offset":"8355647"},"index.mjs":{"size":299,"integrity":{"algorithm":"SHA256","hash":"b75d22297e1bd8992f86218f1749435d05921d2d765697e46a43f680b2edc859","blockSize":4

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\resources\elevate.exe

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):107520
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.442687067441468
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
                                                                                                                                                                                                                                                                                                        MD5:792B92C8AD13C46F27C7CED0810694DF
                                                                                                                                                                                                                                                                                                        SHA1:D8D449B92DE20A57DF722DF46435BA4553ECC802
                                                                                                                                                                                                                                                                                                        SHA-256:9B1FBF0C11C520AE714AF8AA9AF12CFD48503EEDECD7398D8992EE94D1B4DC37
                                                                                                                                                                                                                                                                                                        SHA-512:6C247254DC18ED81213A978CCE2E321D6692848C64307097D2C43432A42F4F4F6D3CF22FB92610DFA8B7B16A5F1D94E9017CF64F88F2D08E79C0FE71A9121E40
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..O..............h.......j.q.....k.....e......e......e.......zR........._...h......h.f.............h......Rich....................PE..L......W............................l........0....@.......................................@....................................P.......x.......................T.......p...............................@............0..$............................text............................... ..`.rdata...k...0...l..................@..@.data...............................@....gfids..............................@..@.rsrc...x...........................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\snapshot_blob.bin

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):273328
                                                                                                                                                                                                                                                                                                        Entropy (8bit):3.2521912102596153
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:1536:HpeVehd7eASb6iAGm4hmWRSJTnBSki+TzUNp2Zg+TWJ0xEI2tWaw8MCZ72T04GO9:NdyNm4mWRSJTBSX4U1hJzbYB
                                                                                                                                                                                                                                                                                                        MD5:4EBD06BDF6CF8DACF6597586FD1704B5
                                                                                                                                                                                                                                                                                                        SHA1:E6819EF37F99F91468F4B94370A4AB467A075A6D
                                                                                                                                                                                                                                                                                                        SHA-256:148E4B85983F0D27ADECD9C6431B66379AC5538688F320E89D74FF6D48BB740B
                                                                                                                                                                                                                                                                                                        SHA-512:17ED5ABE702748B4626B3EE6DE4D0916738F095C913C2700EEE06B65A2BBCAF72AFC1F87AF7CE0FCCE8BD15FE6881508255D397A346C45A82C7791B9B9833DDF
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:.........+.11.2.214.22-electron.0...........................................;...b...........:..a........a........a........ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\v8_context_snapshot.bin

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):588152
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.837375324466163
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:EFzofuYUahtcOm3A0Sg8zY6y4XrxXSIIBYgHi:6Mfu/f2Y6zrM9C7
                                                                                                                                                                                                                                                                                                        MD5:146E284750735EF4798527DC1CD0E741
                                                                                                                                                                                                                                                                                                        SHA1:6408985B7D05C768A62BCB912234F14E1898FFDB
                                                                                                                                                                                                                                                                                                        SHA-256:3820E8FA1077D02606FEA8E1B3A9CA4BF7F4A71D0569D9A8EA9EE7A009D0CE80
                                                                                                                                                                                                                                                                                                        SHA-512:46824DF5D20E02FB72C3EFD07BEE6D832B1AB78C0163688FA84EDB831CBFBEF2DDE12BA9DA01F9DD49C4008BD3862A95699A2F6D55B8D4B3165976D3851C7278
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:........$c^X11.2.214.22-electron.0..........................................H...P<..........X...........a........a........aT.......ar.......a........a..............Y.D............`$.........D............`$.......D............`$.......m.D............`$.........D............`D.........D............`$.......1.D............`$.......D............`$.......D............`$.........D............`$.......D............`$......ID............`$.......D............`$.......D............`$....(Jb....I.....@..F^......`.....(Jb....M.....@..F^..`.....H...IDa........D`....D`....D`.......D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\vk_swiftshader.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):5334528
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.3349883465807055
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:98304:5aTPSALpajr/PMMPTZTOWvYQ7klZz8Wd4iRk:Elajr/PMMPTZTOWvCJ4Z
                                                                                                                                                                                                                                                                                                        MD5:750CBDFB01943E28E08708183EC208B5
                                                                                                                                                                                                                                                                                                        SHA1:1BEE0CD3D0970834B2A47DAF384354F243FD1EE0
                                                                                                                                                                                                                                                                                                        SHA-256:A6D295DCC3AFCB55AA79EAC5F896BCEB15CCB2B798DB3BB076CEEEA78073791A
                                                                                                                                                                                                                                                                                                        SHA-512:DBFDF76F40558CE2F23CA315B8719E283F0F22F46E733F37C2AE237FDAFD23CF7962F36547BA1BB2D5B219DE11546C3DC06859FAC498A7DA97DF41018C0D80C4
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ......A..........;.......................................R...........`A..........................................L.~...&.L.P....`R.......P.<_...........pR.P}...L.......................L.(...@.A.@.............L.P............................text.....A.......A................. ..`.rdata...(....A..*....A.............@..@.data...p.....M.......M.............@....pdata..<_....P..`...LO.............@..@.00cfg..8.....Q.......P.............@..@.gxfg....,....R.......P.............@..@.retplne.....0R.......P..................tls....Q....@R.......P.............@..._RDATA..\....PR.......P.............@..@.rsrc........`R.......P.............@..@.reloc..P}...pR..~....P.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\vk_swiftshader_icd.json

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):106
                                                                                                                                                                                                                                                                                                        Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                                                                                                        MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                                                                                        SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                                                                                        SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                                                                                        SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\7z-out\vulkan-1.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):928256
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.558001659108061
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:24576:yGZKHQwvuzUrfafN/iXxT+R6Z5WODYsHh6g3P0zAk7a:GwwvuziiV/iXxc6Z5WODYsHh6g3P0zAu
                                                                                                                                                                                                                                                                                                        MD5:6C70AAB071C4FEBC5921E0D39811937A
                                                                                                                                                                                                                                                                                                        SHA1:20D87B3A5333EA3F6D0D7B0333F2C30A281937AA
                                                                                                                                                                                                                                                                                                        SHA-256:2233FEF6788711089FC5C1A008BFFF6559CF2FC3E8363CD8A50196E90D1D9825
                                                                                                                                                                                                                                                                                                        SHA-512:7F786C44376B59BE7D7C51D3C40ECB80F30645551B582D042B641EA0A6464DAF367DDF7EAFAF00A1558E1F11570D99A699D33D224B01048D09F8F00EA501C4BF
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....&e.........." ......................................................................`A........................................H...<!......P...............<o..............T...t.......................X...(...@...@............................................text...v~.......................... ..`.rdata..............................@..@.data....L...p... ...V..............@....pdata..<o.......p...v..............@..@.00cfg..8....0......................@..@.gxfg...P(...@...*..................@..@.retplne.....p...........................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\SpiderBanner.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):9216
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.5347224014600345
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
                                                                                                                                                                                                                                                                                                        MD5:17309E33B596BA3A5693B4D3E85CF8D7
                                                                                                                                                                                                                                                                                                        SHA1:7D361836CF53DF42021C7F2B148AEC9458818C01
                                                                                                                                                                                                                                                                                                        SHA-256:996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
                                                                                                                                                                                                                                                                                                        SHA-512:1ABAC3CE4F2D5E4A635162E16CF9125E059BA1539F70086C2D71CD00D41A6E2A54D468E6F37792E55A822D7082FB388B8DFECC79B59226BBB047B7D28D44D298
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../../../..Wy./../../....../..Wi./..Wx./..W~./..W{./..Rich./..................PE..L...T{mW...........!................p!.......0...............................p............@..........................5..o...l1..P....P.......................`.......................................................0...............................text............................... ..`.rdata.......0......................@..@.data........@......................@....rsrc........P......................@..@.reloc..d....`....... ..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\StdUtils.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):102400
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.729923587623207
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
                                                                                                                                                                                                                                                                                                        MD5:C6A6E03F77C313B267498515488C5740
                                                                                                                                                                                                                                                                                                        SHA1:3D49FC2784B9450962ED6B82B46E9C3C957D7C15
                                                                                                                                                                                                                                                                                                        SHA-256:B72E9013A6204E9F01076DC38DABBF30870D44DFC66962ADBF73619D4331601E
                                                                                                                                                                                                                                                                                                        SHA-512:9870C5879F7B72836805088079AD5BBAFCB59FC3D9127F2160D4EC3D6E88D3CC8EBE5A9F5D20A4720FE6407C1336EF10F33B2B9621BC587E930D4CBACF337803
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q....C...C...C...C...C...C...C...C...C...C...C...C...C.[.C...C.[.C...C.[.C...C.[.C...CRich...C........................PE..L...I..[...........!.....*...b...............@.......................................+....@..........................}..d....t..........X............................................................................@...............................text....).......*.................. ..`.rdata..TC...@...D..................@..@.data...l............r..............@....rsrc...X............x..............@..@.reloc..j............~..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\System.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.719859767584478
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
                                                                                                                                                                                                                                                                                                        MD5:0D7AD4F45DC6F5AA87F606D0331C6901
                                                                                                                                                                                                                                                                                                        SHA1:48DF0911F0484CBE2A8CDD5362140B63C41EE457
                                                                                                                                                                                                                                                                                                        SHA-256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
                                                                                                                                                                                                                                                                                                        SHA-512:C07DE7308CB54205E8BD703001A7FE4FD7796C9AC1B4BB330C77C872BF712B093645F40B80CE7127531FE6746A5B66E18EA073AB6A644934ABED9BB64126FEA9
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....~.\...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\app-64.7z

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):78562637
                                                                                                                                                                                                                                                                                                        Entropy (8bit):7.999995440541117
                                                                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                                                                        SSDEEP:1572864:KJ39Kk9MrWJx/iB8ceyIS7nqYdd6hIEhSmn6nlN/DFCt:5k9MrWJ4/vP7nMhJnUXDIt
                                                                                                                                                                                                                                                                                                        MD5:E8AF1B6107FD13DBB7018F9F816F4E37
                                                                                                                                                                                                                                                                                                        SHA1:92CD71A61C76A4AC81CA52916A800D6B4B603311
                                                                                                                                                                                                                                                                                                        SHA-256:A4A80B800DF888CB6CA56F172109104966273140F3BAC1DA06325FD7F7BEF520
                                                                                                                                                                                                                                                                                                        SHA-512:A0D9499B530D3F63D6CD4CFCDDC6463B225BFCA4EC981249DCE6CD7DDD17D9912AB4FD211A7077B023452EF8112B921120F9BE2A9C962C81243AA81693E0B249
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:7z..'....c.........%..........}..R..]...6...#k.![y.`.Gr#.f..F......./.t..C..8.^..k .....@..........ih..w*.`.c...I...;.R.A`../_.Q:..yn........6...a {.f_.....>..`..Nu.....q/..H...hsIhA.5..... .9.[...L./.(.^.+Vz@.Dt7OZI.z.N...~;].rW..k......s...^<i ...w.`3.}............T.Z.v.m..W8..m...........k..8..w+.8..9N.C......._; ..u.J........i43.d.......`....r."O.E...'.{h....'....$.M.$..Y....&.+.r|T....aF.T.9...&..sh....I..;.qP.Y..........V..^..P.:...D.."..@Cw...%8.h.5....6V/0..]....%7.Z.P..w..J..].....M..^......+..BMZ..&..}.6l..hT..t).?2....1...F..H..+...0.s.}.S.-x;...f.b}....8.R.@.....r.....Ib......$(/^XdI..46G..Q....`......h..H.U......p..[.Sa-Q@G.......h!....Z....2$.^.IqZ...~~CUB..#.nAp5.k..K....O".G.(......N...>`.k.....;.~A.X.e.mzUq.L...o..PH..WxfRH..z..dT!."d.W.4...Tx... ..Y<..1.P.#.W..Z7.f.z.R...u6.......C.+?.....p.d........".<.../h.Y..`u<m.y.u.Lh.Fz...#...F).,..G.~..'..Mx.s:3..V..m..[%.B.V[...V.Id_.~i6..$...H.ywyg.D.lA.`.H..+..X..@H....

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\nse79D5.tmp\nsis7z.dll

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):434176
                                                                                                                                                                                                                                                                                                        Entropy (8bit):6.584811966667578
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
                                                                                                                                                                                                                                                                                                        MD5:80E44CE4895304C6A3A831310FBF8CD0
                                                                                                                                                                                                                                                                                                        SHA1:36BD49AE21C460BE5753A904B4501F1ABCA53508
                                                                                                                                                                                                                                                                                                        SHA-256:B393F05E8FF919EF071181050E1873C9A776E1A0AE8329AEFFF7007D0CADF592
                                                                                                                                                                                                                                                                                                        SHA-512:C8BA7B1F9113EAD23E993E74A48C4427AE3562C1F6D9910B2BBE6806C9107CF7D94BC7D204613E4743D0CD869E00DAFD4FB54AAD1E8ADB69C553F3B9E5BC64DF
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.6a..X2..X2..X2m.[3..X2m.]3..X2Z.]3+.X2Z.\3..X2Z.[3..X2m.\3..X2m.Y3..X2..Y2..X2..\3#.X2..]3..X2..X3..X2...2..X2...2..X2..Z3..X2Rich..X2........PE..L.....\...........!......................... ...............................@............@..........................6.......7..d................................E.....................................@............ ...............................text............................... ..`.rdata..8"... ...$..................@..@.data........P... ...6..............@....rsrc................V..............@..@.reloc...E.......F...Z..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\passwords_0.db

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\passwords_36.db

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):57344
                                                                                                                                                                                                                                                                                                        Entropy (8bit):0.863060653641558
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
                                                                                                                                                                                                                                                                                                        MD5:C681C90B3AAD7F7E4AF8664DE16971DF
                                                                                                                                                                                                                                                                                                        SHA1:9F72588CEA6569261291B19E06043A1EFC3653BC
                                                                                                                                                                                                                                                                                                        SHA-256:ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
                                                                                                                                                                                                                                                                                                        SHA-512:4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\All_Wallets.zip

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:Zip archive data (empty)
                                                                                                                                                                                                                                                                                                        Category:modified
                                                                                                                                                                                                                                                                                                        Size (bytes):22
                                                                                                                                                                                                                                                                                                        Entropy (8bit):1.0476747992754052
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:3:pjt/l:Nt
                                                                                                                                                                                                                                                                                                        MD5:76CDB2BAD9582D23C1F6F4D868218D6C
                                                                                                                                                                                                                                                                                                        SHA1:B04F3EE8F5E43FA3B162981B50BB72FE1ACABB33
                                                                                                                                                                                                                                                                                                        SHA-256:8739C76E681F900923B900C9DF0EF75CF421D39CABB54650C4B9AD19B6A76D85
                                                                                                                                                                                                                                                                                                        SHA-512:5E2F959F36B66DF0580A94F384C5FC1CEEEC4B2A3925F062D7B68F21758B86581AC2ADCFDDE73A171A28496E758EF1B23CA4951C05455CDAE9357CC3B5A5825F
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:PK....................

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\unrealgame\0cc094ac-33b7-43d4-af16-4d31ea9e0fdd.tmp

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):389
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.599548650286727
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12:YKWSg99rrt+PHzEgkF0xTsHhlGz3oBO7wpyOKBCO1:YKWfrrtAC0JAGbcOpOTo
                                                                                                                                                                                                                                                                                                        MD5:024E312D1E1D3CDA5BDA1D9E40CA1E39
                                                                                                                                                                                                                                                                                                        SHA1:05215BC89A9358FFB16C8F00A263B43C3FBF58F1
                                                                                                                                                                                                                                                                                                        SHA-256:622C70754AEDD4EE34ED39E960F84E006EEE9FF572BF4FA662B14D8B015B8815
                                                                                                                                                                                                                                                                                                        SHA-512:04BEA99AE1A1A817E624C778D596D4B9BA9C190C1A237054BA3E57579A4BF4A78E6B50EE7D6AEC92C14DF28615A48377FB2EB1AA1E64CC5CE0B7111844E80044
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA7nGpp1gOERJDFeCbMTomaAAAAAAIAAAAAABBmAAAAAQAAIAAAAP/5uCkvnPEOaxyC2zAbIQx2Xtk12Re8eDF6D87/ZwS2AAAAAA6AAAAAAgAAIAAAAHIsM4kkXeSBR520E3V7VculWhZQO0M5ZdckNiutMxh1MAAAADhelaKFZi4UJ/uE2bs4bBd9wnom3MFUNeScz+aUnzEfoZqwjPgnjyuOBQ73jWWJIEAAAADCHTT+H7J7/bgUlXAFh8Ke51LEygzZvu1MhwxuSbUakVEFDSR7BdCQffyOZ3+ICJy6Xy1CkoO3zWfJuqCEem4A"}}

                                                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\unrealgame\Local State (copy)

                                                                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                                                                        Size (bytes):389
                                                                                                                                                                                                                                                                                                        Entropy (8bit):5.599548650286727
                                                                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                                                                        SSDEEP:12:YKWSg99rrt+PHzEgkF0xTsHhlGz3oBO7wpyOKBCO1:YKWfrrtAC0JAGbcOpOTo
                                                                                                                                                                                                                                                                                                        MD5:024E312D1E1D3CDA5BDA1D9E40CA1E39
                                                                                                                                                                                                                                                                                                        SHA1:05215BC89A9358FFB16C8F00A263B43C3FBF58F1
                                                                                                                                                                                                                                                                                                        SHA-256:622C70754AEDD4EE34ED39E960F84E006EEE9FF572BF4FA662B14D8B015B8815
                                                                                                                                                                                                                                                                                                        SHA-512:04BEA99AE1A1A817E624C778D596D4B9BA9C190C1A237054BA3E57579A4BF4A78E6B50EE7D6AEC92C14DF28615A48377FB2EB1AA1E64CC5CE0B7111844E80044
                                                                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                                                                        Preview:{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA7nGpp1gOERJDFeCbMTomaAAAAAAIAAAAAABBmAAAAAQAAIAAAAP/5uCkvnPEOaxyC2zAbIQx2Xtk12Re8eDF6D87/ZwS2AAAAAA6AAAAAAgAAIAAAAHIsM4kkXeSBR520E3V7VculWhZQO0M5ZdckNiutMxh1MAAAADhelaKFZi4UJ/uE2bs4bBd9wnom3MFUNeScz+aUnzEfoZqwjPgnjyuOBQ73jWWJIEAAAADCHTT+H7J7/bgUlXAFh8Ke51LEygzZvu1MhwxuSbUakVEFDSR7BdCQffyOZ3+ICJy6Xy1CkoO3zWfJuqCEem4A"}}

                                                                                                                                                                                                                                                                                                        Static File Info

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                                                                                                        Entropy (8bit):7.999980602541402
                                                                                                                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                                                                                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                                                                                        File name:MayitaV16.exe
                                                                                                                                                                                                                                                                                                        File size:79'067'379 bytes
                                                                                                                                                                                                                                                                                                        MD5:e5bb039da501cae7edddf9268ec43741
                                                                                                                                                                                                                                                                                                        SHA1:a7571b4b9a2c93187f20bf4de5d7852154b15216
                                                                                                                                                                                                                                                                                                        SHA256:e92d4f3c94a734fb23d91270012fe3c13f566d1f3d6b7ec166bd30666cd2b036
                                                                                                                                                                                                                                                                                                        SHA512:bb4f298f7a91af549ef20bce09f807ef8bf815cfc484fb7c3e307af902baf31fe9bda4f5f91f50bcb3f970f52bc3440088454076b65303da24f2e77469533d71
                                                                                                                                                                                                                                                                                                        SSDEEP:1572864:JyJ39Kk9MrWJx/iB8ceyIS7nqYdd6hIEhSmn6nlN/DFC5:JRk9MrWJ4/vP7nMhJnUXDI5
                                                                                                                                                                                                                                                                                                        TLSH:A5083344F28A1614DA0DB8F1BBB9F874D8D0B586B5B3D0F227651F46A86C217BFA04C7
                                                                                                                                                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

                                                                                                                                                                                                                                                                                                        File Icon

                                                                                                                                                                                                                                                                                                        Icon Hash:0771ccf8d84d2907

                                                                                                                                                                                                                                                                                                        Static PE Info

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Entrypoint:0x40338f
                                                                                                                                                                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                                                                                                                                                                        Digitally signed:false
                                                                                                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                                                                                                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                                                                                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                                                                        Time Stamp:0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
                                                                                                                                                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                                                                                                                        OS Version Major:4
                                                                                                                                                                                                                                                                                                        OS Version Minor:0
                                                                                                                                                                                                                                                                                                        File Version Major:4
                                                                                                                                                                                                                                                                                                        File Version Minor:0
                                                                                                                                                                                                                                                                                                        Subsystem Version Major:4
                                                                                                                                                                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                                                                                                                                                                        Import Hash:b34f154ec913d2d2c435cbd644e91687

                                                                                                                                                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                                                                                                                        sub esp, 000002D4h
                                                                                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                                                                                        push edi
                                                                                                                                                                                                                                                                                                        push 00000020h
                                                                                                                                                                                                                                                                                                        pop edi
                                                                                                                                                                                                                                                                                                        xor ebx, ebx
                                                                                                                                                                                                                                                                                                        push 00008001h
                                                                                                                                                                                                                                                                                                        mov dword ptr [esp+14h], ebx
                                                                                                                                                                                                                                                                                                        mov dword ptr [esp+10h], 0040A2E0h
                                                                                                                                                                                                                                                                                                        mov dword ptr [esp+1Ch], ebx
                                                                                                                                                                                                                                                                                                        call dword ptr [004080A8h]
                                                                                                                                                                                                                                                                                                        call dword ptr [004080A4h]
                                                                                                                                                                                                                                                                                                        and eax, BFFFFFFFh
                                                                                                                                                                                                                                                                                                        cmp ax, 00000006h
                                                                                                                                                                                                                                                                                                        mov dword ptr [0047AEECh], eax
                                                                                                                                                                                                                                                                                                        je 00007F9F44DBA9C3h
                                                                                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                                                                                        call 00007F9F44DBDC75h
                                                                                                                                                                                                                                                                                                        cmp eax, ebx
                                                                                                                                                                                                                                                                                                        je 00007F9F44DBA9B9h
                                                                                                                                                                                                                                                                                                        push 00000C00h
                                                                                                                                                                                                                                                                                                        call eax
                                                                                                                                                                                                                                                                                                        mov esi, 004082B0h
                                                                                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                                                                                        call 00007F9F44DBDBEFh
                                                                                                                                                                                                                                                                                                        push esi
                                                                                                                                                                                                                                                                                                        call dword ptr [00408150h]
                                                                                                                                                                                                                                                                                                        lea esi, dword ptr [esi+eax+01h]
                                                                                                                                                                                                                                                                                                        cmp byte ptr [esi], 00000000h
                                                                                                                                                                                                                                                                                                        jne 00007F9F44DBA99Ch
                                                                                                                                                                                                                                                                                                        push 0000000Ah
                                                                                                                                                                                                                                                                                                        call 00007F9F44DBDC48h
                                                                                                                                                                                                                                                                                                        push 00000008h
                                                                                                                                                                                                                                                                                                        call 00007F9F44DBDC41h
                                                                                                                                                                                                                                                                                                        push 00000006h
                                                                                                                                                                                                                                                                                                        mov dword ptr [0047AEE4h], eax
                                                                                                                                                                                                                                                                                                        call 00007F9F44DBDC35h
                                                                                                                                                                                                                                                                                                        cmp eax, ebx
                                                                                                                                                                                                                                                                                                        je 00007F9F44DBA9C1h
                                                                                                                                                                                                                                                                                                        push 0000001Eh
                                                                                                                                                                                                                                                                                                        call eax
                                                                                                                                                                                                                                                                                                        test eax, eax
                                                                                                                                                                                                                                                                                                        je 00007F9F44DBA9B9h
                                                                                                                                                                                                                                                                                                        or byte ptr [0047AEEFh], 00000040h
                                                                                                                                                                                                                                                                                                        push ebp
                                                                                                                                                                                                                                                                                                        call dword ptr [00408044h]
                                                                                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                                                                                        call dword ptr [004082A0h]
                                                                                                                                                                                                                                                                                                        mov dword ptr [0047AFB8h], eax
                                                                                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                                                                                        lea eax, dword ptr [esp+34h]
                                                                                                                                                                                                                                                                                                        push 000002B4h
                                                                                                                                                                                                                                                                                                        push eax
                                                                                                                                                                                                                                                                                                        push ebx
                                                                                                                                                                                                                                                                                                        push 00440208h
                                                                                                                                                                                                                                                                                                        call dword ptr [00408188h]
                                                                                                                                                                                                                                                                                                        push 0040A2C8h

                                                                                                                                                                                                                                                                                                        Rich Headers

                                                                                                                                                                                                                                                                                                        Programming Language:
                                                                                                                                                                                                                                                                                                        • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                                                                                                                                                        Data Directories

                                                                                                                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x19f0000x5a70.rsrc
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                                                                        Sections

                                                                                                                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                                                                        .text0x10000x66270x68007618d4c0cd8bb67ea9595b4266b3a91fFalse0.6646259014423077data6.450282348506287IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                                        .rdata0x80000x14a20x1600eecac1fed9cc6b447d50940d178404d8False0.4405184659090909data5.025178929113415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                                        .data0xa0000x70ff80x600db8f31a08a2242d80c29e1f9500c6527False0.5182291666666666data4.037117731448378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                                                                        .ndata0x7b0000x1240000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                                                                        .rsrc0x19f0000x5a700x5c007356b1ed813f9f79008f793d1f6a8ee3False0.490531589673913data5.4006605292220335IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                                                                                        Resources

                                                                                                                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                                                                        RT_ICON0x19f5c80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.7213883677298312
                                                                                                                                                                                                                                                                                                        RT_ICON0x1a06700xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colorsEnglishUnited States0.6751066098081023
                                                                                                                                                                                                                                                                                                        RT_ICON0x1a15180x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colorsEnglishUnited States0.7851985559566786
                                                                                                                                                                                                                                                                                                        RT_ICON0x1a1dc00x568Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colorsEnglishUnited States0.6560693641618497
                                                                                                                                                                                                                                                                                                        RT_ICON0x1a23280x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.8031914893617021
                                                                                                                                                                                                                                                                                                        RT_ICON0x1a27900x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 640EnglishUnited States0.3118279569892473
                                                                                                                                                                                                                                                                                                        RT_ICON0x1a2a780x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishUnited States0.36824324324324326
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a2ba00x202dataEnglishUnited States0.4085603112840467
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a2da80xf8dataEnglishUnited States0.6290322580645161
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a2ea00xeedataEnglishUnited States0.6260504201680672
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a2f900x1fadataEnglishUnited States0.40118577075098816
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a31900xf0dataEnglishUnited States0.6666666666666666
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a32800xe6dataEnglishUnited States0.6565217391304348
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a33680x1eedataEnglishUnited States0.38866396761133604
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a35580xe4dataEnglishUnited States0.6447368421052632
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a36400xdadataEnglishUnited States0.6422018348623854
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a37200x1eedataEnglishUnited States0.3866396761133603
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a39100xe4dataEnglishUnited States0.6359649122807017
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a39f80xdadataEnglishUnited States0.6376146788990825
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a3ad80x1f2dataEnglishUnited States0.39759036144578314
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a3cd00xe8dataEnglishUnited States0.6508620689655172
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a3db80xdedataEnglishUnited States0.6486486486486487
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a3e980x202dataEnglishUnited States0.42217898832684825
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a40a00xf8dataEnglishUnited States0.6653225806451613
                                                                                                                                                                                                                                                                                                        RT_DIALOG0x1a41980xeedataEnglishUnited States0.6512605042016807
                                                                                                                                                                                                                                                                                                        RT_GROUP_ICON0x1a42880x68dataEnglishUnited States0.6634615384615384
                                                                                                                                                                                                                                                                                                        RT_VERSION0x1a42f00x354dataEnglishUnited States0.47300469483568075
                                                                                                                                                                                                                                                                                                        RT_MANIFEST0x1a46480x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

                                                                                                                                                                                                                                                                                                        Imports

                                                                                                                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                                                                                                                        KERNEL32.dllSetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
                                                                                                                                                                                                                                                                                                        USER32.dllGetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
                                                                                                                                                                                                                                                                                                        GDI32.dllSelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
                                                                                                                                                                                                                                                                                                        SHELL32.dllSHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
                                                                                                                                                                                                                                                                                                        ADVAPI32.dllAdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
                                                                                                                                                                                                                                                                                                        COMCTL32.dllImageList_Create, ImageList_AddMasked, ImageList_Destroy
                                                                                                                                                                                                                                                                                                        ole32.dllOleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

                                                                                                                                                                                                                                                                                                        Possible Origin

                                                                                                                                                                                                                                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                                                                                        EnglishUnited States

                                                                                                                                                                                                                                                                                                        Network Behavior

                                                                                                                                                                                                                                                                                                        Network Port Distribution

                                                                                                                                                                                                                                                                                                        TCP Packets

                                                                                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:39.724490881 CET49739443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:39.724533081 CET44349739172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:39.724615097 CET49739443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:39.725223064 CET49739443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:39.725235939 CET44349739172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.038465977 CET44349739172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.040821075 CET49739443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.040831089 CET44349739172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.042388916 CET44349739172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.042463064 CET49739443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.044950008 CET49739443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.045017004 CET44349739172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.045181990 CET44349739172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.045239925 CET49739443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.045469046 CET49739443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.060882092 CET49740443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.060957909 CET44349740172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.061084032 CET49740443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.061417103 CET49740443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:41.061444044 CET44349740172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:42.407795906 CET44349740172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:42.408266068 CET49740443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:42.408293009 CET44349740172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:42.411201000 CET44349740172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:42.411292076 CET49740443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:42.412319899 CET49740443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:42.412364960 CET44349740172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:42.412429094 CET49740443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:42.417381048 CET49742443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:42.417409897 CET44349742172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:42.417618990 CET49742443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:42.417923927 CET49742443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:42.417939901 CET44349742172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.685147047 CET44349742172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.685750961 CET49742443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.685812950 CET44349742172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.687109947 CET44349742172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.687241077 CET49742443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.688011885 CET49742443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.688096046 CET44349742172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.688278913 CET44349742172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.688370943 CET49742443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.688371897 CET49742443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.841696978 CET49743443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.841742992 CET4434974345.112.123.126192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.842387915 CET49743443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.842387915 CET49743443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.842418909 CET4434974345.112.123.126192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:45.254786968 CET4434974345.112.123.126192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:45.255182028 CET49743443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:45.255211115 CET4434974345.112.123.126192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:45.256867886 CET4434974345.112.123.126192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:45.256937981 CET49743443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:45.257810116 CET49743443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:45.257865906 CET4434974345.112.123.126192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:45.258024931 CET4434974345.112.123.126192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:45.258075953 CET49743443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:45.258095026 CET49743443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.211141109 CET49748443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.211179972 CET44349748142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.211240053 CET49748443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.211271048 CET49749443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.211294889 CET44349749142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.211354971 CET49749443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.211462021 CET49748443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.211479902 CET44349748142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.211652040 CET49749443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.211678028 CET44349749142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.268748999 CET49750443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.268779039 CET44349750142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.268847942 CET49750443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.269196987 CET49750443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.269226074 CET44349750142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.304965973 CET49751443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.304991961 CET44349751142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.305063963 CET49751443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.305252075 CET49751443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.305282116 CET44349751142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.935271978 CET49754443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.935311079 CET44349754162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.935442924 CET49754443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.945174932 CET44349748142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.986994982 CET49748443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.015759945 CET44349749142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.023020983 CET49754443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.023045063 CET44349754162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.035159111 CET49748443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.035188913 CET44349748142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.035240889 CET49749443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.035250902 CET44349749142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.036770105 CET44349748142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.036850929 CET49748443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.037065029 CET44349749142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.037125111 CET49749443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.038089991 CET44349750142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.083101988 CET44349751142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.084943056 CET49749443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.085094929 CET44349749142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.088409901 CET49748443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.088515997 CET44349748142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.092106104 CET49750443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.092128038 CET44349750142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.093632936 CET44349750142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.093651056 CET44349750142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.093806028 CET49750443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.095931053 CET49751443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.095948935 CET44349751142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.099518061 CET44349751142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.099591970 CET49751443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.099641085 CET49750443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.099725008 CET49749443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.099756002 CET44349749142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.099770069 CET44349750142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.099802971 CET49748443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.099834919 CET44349748142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.103177071 CET49751443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.103388071 CET44349751142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.103406906 CET49750443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.103415012 CET44349750142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.103450060 CET49751443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.140192032 CET49748443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.142657042 CET49749443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.151357889 CET44349751142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.155795097 CET49750443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.155797005 CET49751443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.155812979 CET44349751142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.202680111 CET49751443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.270232916 CET49748443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.270349979 CET44349748142.250.181.100192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.270435095 CET49748443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.503068924 CET49750443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.503098011 CET49749443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.503133059 CET49751443192.168.2.4142.250.181.100
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.776179075 CET49755443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.776228905 CET44349755162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.776297092 CET49755443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.940532923 CET49755443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:49.940577984 CET44349755162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:50.305802107 CET44349754162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:50.358161926 CET49754443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:50.573260069 CET49754443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:50.573318958 CET44349754162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:50.574527025 CET44349754162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:50.574542999 CET44349754162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:50.574621916 CET49754443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:50.814250946 CET49754443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:50.814469099 CET44349754162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:50.815788984 CET49754443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:50.815813065 CET44349754162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:50.859466076 CET49754443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.113178968 CET49756443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.113221884 CET44349756162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.113296986 CET49756443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.113673925 CET49756443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.113692999 CET44349756162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.202567101 CET44349755162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.203011036 CET49755443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.203042030 CET44349755162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.204030991 CET44349755162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.204087019 CET49755443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.204874039 CET49755443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.204935074 CET44349755162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.205086946 CET49755443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.245039940 CET44349754162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.245106936 CET44349754162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.245182991 CET49754443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.250166893 CET49755443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.250180006 CET44349755162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.275352001 CET49754443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.275393009 CET44349754162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.296578884 CET49755443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.717128038 CET44349755162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.717305899 CET44349755162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.717376947 CET49755443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.808406115 CET49755443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.808428049 CET44349755162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.368026018 CET44349756162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.368463993 CET49756443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.368491888 CET44349756162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.369934082 CET44349756162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.369983912 CET49756443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.370822906 CET49756443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.370909929 CET44349756162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.378885984 CET49756443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.378895044 CET44349756162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.513765097 CET49756443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.814282894 CET44349756162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.814376116 CET44349756162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.814500093 CET49756443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.815109015 CET49756443192.168.2.4162.159.61.3
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:52.815125942 CET44349756162.159.61.3192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:53.502490044 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:53.502538919 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:53.502615929 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:53.503211975 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:53.503226042 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:54.997239113 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:54.997638941 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:54.997673988 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:54.999104023 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:54.999172926 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:54.999979973 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:55.000017881 CET4434976845.112.123.126192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:55.000077009 CET49768443192.168.2.445.112.123.126
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:55.104418039 CET49770443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:55.104471922 CET44349770172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:55.104610920 CET49770443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:55.104844093 CET49770443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:55.104861021 CET44349770172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:56.414994955 CET44349770172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:56.415287018 CET49770443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:56.415323019 CET44349770172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:56.416440010 CET44349770172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:56.416498899 CET49770443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:56.417515993 CET49770443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:56.417555094 CET44349770172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:56.417659998 CET49770443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:58.349553108 CET49771443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:58.349630117 CET44349771172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:58.349745035 CET49771443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:58.350397110 CET49771443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:58.350434065 CET44349771172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:59.568276882 CET44349771172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:59.568696022 CET49771443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:59.568732023 CET44349771172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:59.569938898 CET44349771172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:59.570008993 CET49771443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:59.571057081 CET49771443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:59.571120977 CET44349771172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:59.571182966 CET49771443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:59.575793028 CET49772443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:59.575890064 CET44349772172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:59.576003075 CET49772443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:59.576517105 CET49772443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:59.576556921 CET44349772172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:37:00.897505999 CET44349772172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:37:00.897964001 CET49772443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:37:00.898029089 CET44349772172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:37:00.899252892 CET44349772172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:37:00.899389029 CET49772443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:37:00.900077105 CET49772443192.168.2.4172.67.169.156
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:37:00.900124073 CET44349772172.67.169.156192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:37:00.900228977 CET49772443192.168.2.4172.67.169.156

                                                                                                                                                                                                                                                                                                        UDP Packets

                                                                                                                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:39.393799067 CET5814853192.168.2.41.1.1.1
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:39.721038103 CET53581481.1.1.1192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.705581903 CET5680653192.168.2.41.1.1.1
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.839545012 CET53568061.1.1.1192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.070888996 CET5684653192.168.2.41.1.1.1
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.070888996 CET6243053192.168.2.41.1.1.1
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.157778978 CET53554271.1.1.1192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.208831072 CET53568461.1.1.1192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.208859921 CET53599981.1.1.1192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.210778952 CET53624301.1.1.1192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.797838926 CET5783753192.168.2.41.1.1.1
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.797838926 CET5079153192.168.2.41.1.1.1
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.932178020 CET53578371.1.1.1192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.934050083 CET53507911.1.1.1192.168.2.4
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.066730022 CET5947053192.168.2.41.1.1.1
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.090151072 CET4952153192.168.2.41.1.1.1
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.222817898 CET53495211.1.1.1192.168.2.4

                                                                                                                                                                                                                                                                                                        DNS Queries

                                                                                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:39.393799067 CET192.168.2.41.1.1.10x51c0Standard query (0)hexon.funA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.705581903 CET192.168.2.41.1.1.10x2b1cStandard query (0)api.gofile.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.070888996 CET192.168.2.41.1.1.10x9165Standard query (0)www.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.070888996 CET192.168.2.41.1.1.10xf0adStandard query (0)www.google.com65IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.797838926 CET192.168.2.41.1.1.10xd48dStandard query (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.797838926 CET192.168.2.41.1.1.10x8b7dStandard query (0)chrome.cloudflare-dns.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.066730022 CET192.168.2.41.1.1.10xf4b9Standard query (0)ntp.msn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.090151072 CET192.168.2.41.1.1.10xca52Standard query (0)ntp.msn.com65IN (0x0001)false

                                                                                                                                                                                                                                                                                                        DNS Answers

                                                                                                                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:39.721038103 CET1.1.1.1192.168.2.40x51c0No error (0)hexon.fun172.67.169.156A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:39.721038103 CET1.1.1.1192.168.2.40x51c0No error (0)hexon.fun104.21.27.182A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:43.839545012 CET1.1.1.1192.168.2.40x2b1cNo error (0)api.gofile.io45.112.123.126A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.208831072 CET1.1.1.1192.168.2.40x9165No error (0)www.google.com142.250.181.100A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:47.210778952 CET1.1.1.1192.168.2.40xf0adNo error (0)www.google.com65IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.932178020 CET1.1.1.1192.168.2.40xd48dNo error (0)chrome.cloudflare-dns.com65IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.934050083 CET1.1.1.1192.168.2.40x8b7dNo error (0)chrome.cloudflare-dns.com162.159.61.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:48.934050083 CET1.1.1.1192.168.2.40x8b7dNo error (0)chrome.cloudflare-dns.com172.64.41.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.203232050 CET1.1.1.1192.168.2.40xf4b9No error (0)ntp.msn.comwww-msn-com.a-0003.a-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                                                        Nov 22, 2024 00:36:51.222817898 CET1.1.1.1192.168.2.40xca52No error (0)ntp.msn.comwww-msn-com.a-0003.a-msedge.netCNAME (Canonical name)IN (0x0001)false

                                                                                                                                                                                                                                                                                                        HTTP Request Dependency Graph

                                                                                                                                                                                                                                                                                                        • www.google.com
                                                                                                                                                                                                                                                                                                        • chrome.cloudflare-dns.com

                                                                                                                                                                                                                                                                                                        HTTPS Proxied Packets

                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                        0192.168.2.449749142.250.181.1004435820C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:49 UTC615OUTGET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1
                                                                                                                                                                                                                                                                                                        Host: www.google.com
                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                        X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
                                                                                                                                                                                                                                                                                                        Sec-Fetch-Site: none
                                                                                                                                                                                                                                                                                                        Sec-Fetch-Mode: no-cors
                                                                                                                                                                                                                                                                                                        Sec-Fetch-Dest: empty
                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.9


                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                        1192.168.2.449748142.250.181.1004435820C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:49 UTC353OUTGET /async/ddljson?async=ntp:2 HTTP/1.1
                                                                                                                                                                                                                                                                                                        Host: www.google.com
                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                        Sec-Fetch-Site: none
                                                                                                                                                                                                                                                                                                        Sec-Fetch-Mode: no-cors
                                                                                                                                                                                                                                                                                                        Sec-Fetch-Dest: empty
                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.9


                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                        2192.168.2.449750142.250.181.1004435820C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:49 UTC518OUTGET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1
                                                                                                                                                                                                                                                                                                        Host: www.google.com
                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                        X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=
                                                                                                                                                                                                                                                                                                        Sec-Fetch-Site: cross-site
                                                                                                                                                                                                                                                                                                        Sec-Fetch-Mode: no-cors
                                                                                                                                                                                                                                                                                                        Sec-Fetch-Dest: empty
                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.9


                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                        3192.168.2.449751142.250.181.1004435820C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:49 UTC353OUTGET /async/newtab_promos HTTP/1.1
                                                                                                                                                                                                                                                                                                        Host: www.google.com
                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                        Sec-Fetch-Site: cross-site
                                                                                                                                                                                                                                                                                                        Sec-Fetch-Mode: no-cors
                                                                                                                                                                                                                                                                                                        Sec-Fetch-Dest: empty
                                                                                                                                                                                                                                                                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                                                                        Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                                                                                        Accept-Language: en-US,en;q=0.9


                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                        4192.168.2.449754162.159.61.34432800C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:50 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                                                                                                                                                                        Host: chrome.cloudflare-dns.com
                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                        Content-Length: 128
                                                                                                                                                                                                                                                                                                        Accept: application/dns-message
                                                                                                                                                                                                                                                                                                        Accept-Language: *
                                                                                                                                                                                                                                                                                                        User-Agent: Chrome
                                                                                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                                                                                        Content-Type: application/dns-message
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:50 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                                                                        Data Ascii: wwwgstaticcom)TP
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:51 UTC247INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                                                                                        Date: Thu, 21 Nov 2024 23:36:51 GMT
                                                                                                                                                                                                                                                                                                        Content-Type: application/dns-message
                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                                                                                        Content-Length: 468
                                                                                                                                                                                                                                                                                                        CF-RAY: 8e6481169d46c338-EWR
                                                                                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:51 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 10 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                                                                        Data Ascii: wwwgstaticcomA)


                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                        5192.168.2.449755162.159.61.34432800C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:51 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                                                                                                                                                                        Host: chrome.cloudflare-dns.com
                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                        Content-Length: 128
                                                                                                                                                                                                                                                                                                        Accept: application/dns-message
                                                                                                                                                                                                                                                                                                        Accept-Language: *
                                                                                                                                                                                                                                                                                                        User-Agent: Chrome
                                                                                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                                                                                        Content-Type: application/dns-message
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:51 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                                                                        Data Ascii: wwwgstaticcom)TP
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:51 UTC247INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                                                                                        Date: Thu, 21 Nov 2024 23:36:51 GMT
                                                                                                                                                                                                                                                                                                        Content-Type: application/dns-message
                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                                                                                        Content-Length: 468
                                                                                                                                                                                                                                                                                                        CF-RAY: 8e64811a0f0f7d0e-EWR
                                                                                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:51 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                                                                        Data Ascii: wwwgstaticcomP#)


                                                                                                                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                                                        6192.168.2.449756162.159.61.34432800C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:52 UTC245OUTPOST /dns-query HTTP/1.1
                                                                                                                                                                                                                                                                                                        Host: chrome.cloudflare-dns.com
                                                                                                                                                                                                                                                                                                        Connection: keep-alive
                                                                                                                                                                                                                                                                                                        Content-Length: 128
                                                                                                                                                                                                                                                                                                        Accept: application/dns-message
                                                                                                                                                                                                                                                                                                        Accept-Language: *
                                                                                                                                                                                                                                                                                                        User-Agent: Chrome
                                                                                                                                                                                                                                                                                                        Accept-Encoding: identity
                                                                                                                                                                                                                                                                                                        Content-Type: application/dns-message
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:52 UTC128OUTData Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                                                                        Data Ascii: wwwgstaticcom)TP
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:52 UTC247INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                        Server: cloudflare
                                                                                                                                                                                                                                                                                                        Date: Thu, 21 Nov 2024 23:36:52 GMT
                                                                                                                                                                                                                                                                                                        Content-Type: application/dns-message
                                                                                                                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                                                                                                                        Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                                                                                        Content-Length: 468
                                                                                                                                                                                                                                                                                                        CF-RAY: 8e64812119c042a1-EWR
                                                                                                                                                                                                                                                                                                        alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                        2024-11-21 23:36:52 UTC468INData Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 07 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                                                                        Data Ascii: wwwgstaticcom c)


                                                                                                                                                                                                                                                                                                        Statistics

                                                                                                                                                                                                                                                                                                        CPU Usage

                                                                                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                                                                                        Memory Usage

                                                                                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                                                                                                                        Behavior

                                                                                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                                                                                        System Behavior

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:0
                                                                                                                                                                                                                                                                                                        Start time:18:36:08
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\MayitaV16.exe"
                                                                                                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                                                                                                        File size:79'067'379 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:E5BB039DA501CAE7EDDDF9268EC43741
                                                                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:4
                                                                                                                                                                                                                                                                                                        Start time:18:36:33
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe"
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff759b90000
                                                                                                                                                                                                                                                                                                        File size:162'117'120 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:DF1D5E605E98A3A533E6AD7E585442E0
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                                                                                                        • Detection: 8%, ReversingLabs
                                                                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:7
                                                                                                                                                                                                                                                                                                        Start time:18:36:37
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7618a0000
                                                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:8
                                                                                                                                                                                                                                                                                                        Start time:18:36:37
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                        Imagebase:0xbc0000
                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:9
                                                                                                                                                                                                                                                                                                        Start time:18:36:37
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:wmic csproduct get uuid
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff679b50000
                                                                                                                                                                                                                                                                                                        File size:576'000 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:10
                                                                                                                                                                                                                                                                                                        Start time:18:36:39
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff759b90000
                                                                                                                                                                                                                                                                                                        File size:162'117'120 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:DF1D5E605E98A3A533E6AD7E585442E0
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:11
                                                                                                                                                                                                                                                                                                        Start time:18:36:41
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Programs\unrealgame\MayitaV16.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2348 --field-trial-handle=1856,i,4436367812585847446,8332434346284091481,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff759b90000
                                                                                                                                                                                                                                                                                                        File size:162'117'120 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:DF1D5E605E98A3A533E6AD7E585442E0
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:12
                                                                                                                                                                                                                                                                                                        Start time:18:36:44
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff76e190000
                                                                                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:13
                                                                                                                                                                                                                                                                                                        Start time:18:36:44
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2020 --field-trial-handle=1984,i,3138843665654156619,11594928844437088871,262144 /prefetch:8
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff76e190000
                                                                                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:14
                                                                                                                                                                                                                                                                                                        Start time:18:36:48
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff67dcd0000
                                                                                                                                                                                                                                                                                                        File size:4'210'216 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:15
                                                                                                                                                                                                                                                                                                        Start time:18:36:48
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2116 --field-trial-handle=1972,i,14171082060860887493,6740327589289574467,262144 /prefetch:3
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff67dcd0000
                                                                                                                                                                                                                                                                                                        File size:4'210'216 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:18
                                                                                                                                                                                                                                                                                                        Start time:18:36:52
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --no-sandbox --mojo-platform-channel-handle=5364 --field-trial-handle=1972,i,14171082060860887493,6740327589289574467,262144 /prefetch:8
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff67dcd0000
                                                                                                                                                                                                                                                                                                        File size:4'210'216 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:19
                                                                                                                                                                                                                                                                                                        Start time:18:36:54
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7618a0000
                                                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:20
                                                                                                                                                                                                                                                                                                        Start time:18:36:54
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:21
                                                                                                                                                                                                                                                                                                        Start time:18:36:54
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7618a0000
                                                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:22
                                                                                                                                                                                                                                                                                                        Start time:18:36:54
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:23
                                                                                                                                                                                                                                                                                                        Start time:18:36:54
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7618a0000
                                                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:24
                                                                                                                                                                                                                                                                                                        Start time:18:36:54
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:tasklist
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff6bf440000
                                                                                                                                                                                                                                                                                                        File size:106'496 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:25
                                                                                                                                                                                                                                                                                                        Start time:18:36:54
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:26
                                                                                                                                                                                                                                                                                                        Start time:18:36:54
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:tasklist
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff6bf440000
                                                                                                                                                                                                                                                                                                        File size:106'496 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:27
                                                                                                                                                                                                                                                                                                        Start time:18:36:54
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:tasklist
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff6bf440000
                                                                                                                                                                                                                                                                                                        File size:106'496 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:28
                                                                                                                                                                                                                                                                                                        Start time:18:36:55
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7618a0000
                                                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:29
                                                                                                                                                                                                                                                                                                        Start time:18:36:55
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:30
                                                                                                                                                                                                                                                                                                        Start time:18:36:55
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:taskkill /IM EpicGamesLauncher.exe /F
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7fb760000
                                                                                                                                                                                                                                                                                                        File size:101'376 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:A599D3B2FAFBDE4C1A6D7D0F839451C7
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:31
                                                                                                                                                                                                                                                                                                        Start time:18:36:55
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7618a0000
                                                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:32
                                                                                                                                                                                                                                                                                                        Start time:18:36:55
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:33
                                                                                                                                                                                                                                                                                                        Start time:18:36:55
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7618a0000
                                                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:34
                                                                                                                                                                                                                                                                                                        Start time:18:36:55
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:35
                                                                                                                                                                                                                                                                                                        Start time:18:36:55
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:taskkill /F /T /IM chrome.exe
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7fb760000
                                                                                                                                                                                                                                                                                                        File size:101'376 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:A599D3B2FAFBDE4C1A6D7D0F839451C7
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:36
                                                                                                                                                                                                                                                                                                        Start time:18:36:55
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7618a0000
                                                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:37
                                                                                                                                                                                                                                                                                                        Start time:18:36:56
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:38
                                                                                                                                                                                                                                                                                                        Start time:18:36:56
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:taskkill /F /T /IM chrome.exe
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7fb760000
                                                                                                                                                                                                                                                                                                        File size:101'376 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:A599D3B2FAFBDE4C1A6D7D0F839451C7
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:39
                                                                                                                                                                                                                                                                                                        Start time:18:36:56
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:taskkill /F /T /IM chrome.exe
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7fb760000
                                                                                                                                                                                                                                                                                                        File size:101'376 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:A599D3B2FAFBDE4C1A6D7D0F839451C7
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:40
                                                                                                                                                                                                                                                                                                        Start time:18:36:56
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7618a0000
                                                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:41
                                                                                                                                                                                                                                                                                                        Start time:18:36:56
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:42
                                                                                                                                                                                                                                                                                                        Start time:18:36:56
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:taskkill /IM javaw.exe /F
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7fb760000
                                                                                                                                                                                                                                                                                                        File size:101'376 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:A599D3B2FAFBDE4C1A6D7D0F839451C7
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:43
                                                                                                                                                                                                                                                                                                        Start time:18:36:57
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7618a0000
                                                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:44
                                                                                                                                                                                                                                                                                                        Start time:18:36:57
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:45
                                                                                                                                                                                                                                                                                                        Start time:18:36:57
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:taskkill /IM Steam.exe /F
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7fb760000
                                                                                                                                                                                                                                                                                                        File size:101'376 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:A599D3B2FAFBDE4C1A6D7D0F839451C7
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:46
                                                                                                                                                                                                                                                                                                        Start time:18:36:57
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7618a0000
                                                                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:47
                                                                                                                                                                                                                                                                                                        Start time:18:36:57
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                                                                        Target ID:48
                                                                                                                                                                                                                                                                                                        Start time:18:36:57
                                                                                                                                                                                                                                                                                                        Start date:21/11/2024
                                                                                                                                                                                                                                                                                                        Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                                        Commandline:tasklist
                                                                                                                                                                                                                                                                                                        Imagebase:0x7ff6bf440000
                                                                                                                                                                                                                                                                                                        File size:106'496 bytes
                                                                                                                                                                                                                                                                                                        MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                                                                        Disassembly

                                                                                                                                                                                                                                                                                                        ⊘No disassembly