Play interactive tour

Edit tour

Windows Analysis Report VisBridge-1.0.4+Setup.exe

Overview

General Information

Sample Name:	VisBridge-1.0.4+Setup.exe
Analysis ID:	499619
MD5:	b33f67f583b9c1f1f726d15b249d4242
SHA1:	6b554808aa148de2686fbd434f0d20b344bd3b60
SHA256:	081dbbe7d110a89155e0cd7800bc9c1a714e82ceecfa3ef80e733043387b000b
Infos:
Most interesting Screenshot:

Detection

Score:	10
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Compliance

Score:	20
Range:	0 - 100

Signatures

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Drops certificate files (DER)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

EXE planting / hijacking vulnerabilities found

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file does not import any functions

DLL planting / hijacking vulnerabilities found

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Drops PE files

Binary contains a suspicious time stamp

PE file contains more sections than normal

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file overlay found

Creates a process in suspended mode (likely to inject code)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample may be VM or Sandbox-aware, try analysis on a native machine

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64

VisBridge-1.0.4+Setup.exe (PID: 3260 cmdline: 'C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe' MD5: B33F67F583B9C1F1F726D15B249D4242)

Update.exe (PID: 6888 cmdline: 'C:\Users\user\AppData\Local\SquirrelTemp\Update.exe' --install . MD5: C45A02058073AEB5783F40F78CBF6130)

squirrel.exe (PID: 5744 cmdline: 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\Squirrel.exe' --updateSelf=C:\Users\user\AppData\Local\SquirrelTemp\Update.exe MD5: C45A02058073AEB5783F40F78CBF6130)

VisBridge.exe (PID: 5824 cmdline: 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --squirrel-install 1.0.4 MD5: 921F9BAD8A3988D0DF1B9C3255C7DB7F)

VisBridge.exe (PID: 6280 cmdline: 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --squirrel-firstrun MD5: 921F9BAD8A3988D0DF1B9C3255C7DB7F)

VisBridge.exe (PID: 5992 cmdline: 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=gpu-process --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1448 /prefetch:2 MD5: 921F9BAD8A3988D0DF1B9C3255C7DB7F)

VisBridge.exe (PID: 6880 cmdline: 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1812 /prefetch:8 MD5: 921F9BAD8A3988D0DF1B9C3255C7DB7F)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Privilege Escalation:

Source: C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe	EXE: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\VisBridge\VisBridge.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\VisBridge\Update.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: WINSTA.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: MSIMG32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: WINHTTP.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: WINMM.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: D3DCOMPILER_47.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: WTSAPI32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: PROPSYS.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: Secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: SSPICLI.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: CompPkgSup.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\vk_swiftshader.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: VERSION.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: dxva2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	DLL: MSVCP120_CLR0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: USERENV.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: mfplat.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\libGLESv2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	DLL: CRYPTSP.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\pepflashplayer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: CRYPTBASE.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: ColorAdapterClient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: IPHLPAPI.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\libEGL.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: DCIMAN32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\d3dcompiler_47.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: UIAutomationCore.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\vulkan-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: dhcpcsvc.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: WINMMBASE.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: RTWorkQ.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: OLEACC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: WindowsCodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: msmpeg2vdec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: msvproc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: mf.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: psapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: DWrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: ddraw.dll	Jump to behavior

Compliance:

Uses 32bit PE files

Show sources

Source: VisBridge-1.0.4+Setup.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

EXE planting / hijacking vulnerabilities found

Show sources

Source: C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe	EXE: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\VisBridge\VisBridge.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\VisBridge\Update.exe	Jump to behavior

DLL planting / hijacking vulnerabilities found

Show sources

Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: WINSTA.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: MSIMG32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: WINHTTP.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: WINMM.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: D3DCOMPILER_47.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: WTSAPI32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: PROPSYS.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: Secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: SSPICLI.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: CompPkgSup.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\vk_swiftshader.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: VERSION.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: dxva2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	DLL: MSVCP120_CLR0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: USERENV.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: mfplat.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\libGLESv2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	DLL: CRYPTSP.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\pepflashplayer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: CRYPTBASE.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: ColorAdapterClient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: IPHLPAPI.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\libEGL.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: DCIMAN32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\d3dcompiler_47.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: UIAutomationCore.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\vulkan-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: dhcpcsvc.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: WINMMBASE.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: RTWorkQ.DLL	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: OLEACC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: WindowsCodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: msmpeg2vdec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: msvproc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: mf.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	DLL: psapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: DWrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	DLL: ddraw.dll	Jump to behavior

Creates a software uninstall entry

Show sources

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\VisBridge

Jump to behavior

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown

HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.7:49839 version: TLS 1.2

Creates install or setup log file

Show sources

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\SquirrelTemp\SquirrelSetup.log			Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	File created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\SquirrelSetup.log			Jump to behavior

PE / OLE file has a valid certificate

Show sources

Source: VisBridge-1.0.4+Setup.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: VisBridge-1.0.4+Setup.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Show sources

Source:

Binary string: C:\Users\ana\code\Squirrel\Squirrel.Windows\src\Setup\bin\Release\Setup.pdb source: VisBridge-1.0.4+Setup.exe, 00000000.00000000.259408108.0000000000B8E000.00000002.00020000.sdmp

Spreading:

Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File opened: C:\Users\user\AppData\Local\VisBridge	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File opened: C:\Users\user\AppData\Local\VisBridge\app-1.0.4	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File opened: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking:

Source: global traffic

HTTP traffic detected: GET /electron/electron/master/shell/browser/resources/win/electron.ico HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 185.199.108.133 185.199.108.133

Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839

Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://EVSecure-crl.geotrust.com/GeoTrustPCA.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://EVSecure-ocsp.geotrust.com0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://aia.startssl.com/certs/ca.crt0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://aia.startssl.com/certs/ca.crt02
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://aia1.wosign.com/ca1-class3-server.cer0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://aia1.wosign.com/ca1g2-server3.cer0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/gdig2.crt0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository100.
Source: VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp, VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://certs.starfieldtech.com/repository/1402
Source: VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://clients3.google.com/cert_upload_json
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.certum.pl/ca.crl0h
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0;
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.entrust.net/g2ca.crl0;
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.entrust.net/rootca1.crl0;
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.geotrust.com/GeoTrustPCA-G3.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.geotrust.com/crls/gtglobal.crl04
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.geotrust.com/crls/secureca.crl0F
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.geotrust.com/crls/secureca.crl0N
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.globalsign.com/root.crl0V
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.globalsign.net/root.crl0=
Source: VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.godaddy.com/gdig2s5-6.crl0
Source: VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp, VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.godaddy.com/gdroot.crl0F
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.godaddy.com/gds1-20
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.rootg2.amazontrust.com/rootg2.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.starfieldtech.com/sfroot-g2.crl0L
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.starfieldtech.com/sfroot.crl0L
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.startssl.com/sfsca.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.startssl.com/sfsca.crl0f
Source: VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePCA-G3.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePCA.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl.ws.symantec.com/universal-root.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crls1.wosign.com/ca1.crl0m
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crls1.wosign.com/ca1.crl0q
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://crt.rootg2.amazontrust.com/rootg2.cer0=
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only#
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://g.symcb.com/GeoTrustPCA-G3.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://g.symcb.com/crls/gtglobal.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://g.symcb.com/crls/gtglobal.crl0.
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://g.symcd.com0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://g.symcd.com0L
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://g1.symcb.com/GeoTrustPCA.crl0)
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://g1.symcb.com/crls/gtglobal.crl0/
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://g2.symcb.com0G
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://g2.symcb.com0L
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://isrg.trustid.ocsp.identrust.com0;
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://l.twimg.com/i/hpkp_report
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://o.ss2.us/0
Source: VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.digicert.com0M
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.entrust.net00
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.entrust.net02
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.geotrust.com0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.geotrust.com0L
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr10
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.godaddy.com/0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.godaddy.com/02
Source: VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp, VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.godaddy.com/05
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.godaddy.com/0J
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.rootg2.amazontrust.com08
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.starfieldtech.com/08
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.starfieldtech.com/0;
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.startssl.com/ca0-
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.startssl.com/ca00
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.startssl.com00
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.thawte.com0;
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp.ws.symantec.com0k
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp1.wosign.com/ca104
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://ocsp1.wosign.com/ca108
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://pca-g3-ocsp.geotrust.com0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://report-example.test/test
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://report-example.test/testyC
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://repository.certum.pl/ca.cer09
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://s../../net/third_party/quiche/src/quic/core/crypto/certificate_view.cc
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://s../../net/third_party/quiche/src/quic/core/crypto/certificate_view.ccInvalid
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://s.ss2.us/r.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://s2.symcb.com0k
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com0.
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://t.symcb.com/ThawtePCA.crl0)
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://t.symcd.com01
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0)
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0/
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://t2.symcb.com0;
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://t2.symcb.com0A
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.digicert.com/CACerts/DigiCertHighAssuranceEVRootCA.crt0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.entrust.net/CPS0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.entrust.net/rpa0
Source: VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps0)
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps06
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps0;
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps0A
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.keynectis.com/PC07
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.keynectis.com/PC08
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.startssl.com/intermediate.pdf0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.startssl.com/policy.pdf04
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.startssl.com/policy0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.startssl.com/sfsca.crl0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.startssl.com/sfsca.crt0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.symauth.com/rpa0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.symauth.com/rpa0)
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://www.wosign.com/policy/0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: http://x.ss2.us/x.cer0&
Source: squirrel.exe	String found in binary or memory: https://api.github.com/
Source: Update.exe, 0000000B.00000000.307764115.00000000009A2000.00000002.00020000.sdmp, squirrel.exe, 00000017.00000002.515630470.0000000000DF2000.00000002.00020000.sdmp	String found in binary or memory: https://api.github.com/#
Source: VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp, VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://certs.godaddy.com/repository/0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://certs.starfieldtech.com/repository/0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://chrome-devtools-frontend.appspot.com/
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://chrome-devtools-frontend.appspot.com/%s%s/%s/
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://chrome.cloudflare-dns.com/dns-query
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://cleanbrowsing.org/privacy
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://cleanbrowsing.org/privacyCleanBrowsing
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://clients3.google.com/ct_upload
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://clients3.google.com/ct_uploadhttps://log.getdropbox.com/log/expectcthttps://scotthelme.repor
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflare
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://developers.google.com/speed/public-dns/privacy
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://developers.google.com/speed/public-dns/privacyGoogle
Source: VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://dns.google/dns-query
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://dns.quad9.net/dns-query
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://dns.quad9.net/dns-querydns.quad9.netdns9.quad9.net9.9.9.9149.112.112.1122620:fe::fe2620:fe::
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://dns.sb/privacy/
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://dns.switch.ch/dns-query
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://dns.switch.ch/dns-querydns.switch.ch130.59.31.251130.59.31.2482001:620:0:ff::22001:620:0:ff:
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://dns10.quad9.net/dns-query
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://dns11.quad9.net/dns-query
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11h
Source: VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://doh.cleanbrowsing.org/doh/adult-filter
Source: VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://doh.cleanbrowsing.org/doh/family-filter
Source: VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://doh.cleanbrowsing.org/doh/security-filter
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://doh.dns.sb/dns-query
Source: VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://doh.dns.sb/dns-query?no_ecs=true
Source: VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://doh.familyshield.opendns.com/dns-query
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://doh.opendns.com/dns-query
Source: VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://doh.xfinity.com/dns-query
Source: Update.exe, 0000000B.00000000.307764115.00000000009A2000.00000002.00020000.sdmp, squirrel.exe	String found in binary or memory: https://github.com/myuser/myrepo
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://history.report-uri.com/r/d/ct/reportOnly
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://log.getdropbox.com/hpkp
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://log.getdropbox.com/log/expectct
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://matteomarescotti.report-uri.com/r/d/ct/reportOnly
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://odvr.nic.cz/doh
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://odvr.nic.cz/dohodvr.nic.cz185.43.135.12001:148f:fffe::1
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://public.dns.iij.jp/
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://public.dns.iij.jp/IIJ
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://public.dns.iij.jp/dns-query
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://public.dns.iij.jp/dns-queryIijhttps://doh.opendns.com/dns-query
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://scotthelme.report-uri.com/r/d/ct/reportOnly
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://tobiassachs.report-uri.com/r/d/ct/reportOnly
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://www.alphassl.com/repository/03
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://www.geotrust.com/resources/cps04
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://www.geotrust.com/resources/cps06
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://www.geotrust.com/resources/repository0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/03
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://www.quad9.net/home/privacy/
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://www.quad9.net/home/privacy/Quad9
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://www.thawte.com/cps0
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://www.thawte.com/cps0)
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://www.thawte.com/cps02
Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	String found in binary or memory: https://www.thawte.com/cps07

Source: unknown

DNS traffic detected: queries for: raw.githubusercontent.com

Source: global traffic

HTTP traffic detected: GET /electron/electron/master/shell/browser/resources/win/electron.ico HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.7:49839 version: TLS 1.2

E-Banking Fraud:

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

File created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\5835243bf2fd8a85-SHA2.pfx

Jump to dropped file

System Summary:

Source: VisBridge-1.0.4+Setup.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe

Code function: 23_2_01A242E8

23_2_01A242E8

Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Code function: 23_2_01A26430 NtQueryInformationProcess,		23_2_01A26430
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Code function: 23_2_01A26429 NtQueryInformationProcess,		23_2_01A26429

Source: VisBridge-1.0.4+Setup.exe

Static PE information: Resource name: DATA type: Zip archive data, at least v2.0 to extract

Source: VisBridge.exe.11.dr

Static PE information: No import functions for PE file found

Source: VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp

Binary or memory string: OriginalFilenameUpdate.exe. vs VisBridge-1.0.4+Setup.exe

Source: VisBridge.exe.11.dr

Static PE information: Number of sections : 12 > 10

Source: VisBridge.exe.11.dr

Static PE information: Data appended to the last section found

Source: VisBridge-1.0.4+Setup.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe 'C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe'
Source: C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe	Process created: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe 'C:\Users\user\AppData\Local\SquirrelTemp\Update.exe' --install .
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\Squirrel.exe' --updateSelf=C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --squirrel-install 1.0.4
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --squirrel-firstrun
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=gpu-process --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1448 /prefetch:2
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1812 /prefetch:8
Source: C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe	Process created: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe 'C:\Users\user\AppData\Local\SquirrelTemp\Update.exe' --install .	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\Squirrel.exe' --updateSelf=C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --squirrel-install 1.0.4	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --squirrel-firstrun	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=gpu-process --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1448 /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1812 /prefetch:8	Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

File created: C:\Users\user\AppData\Local\VisBridge

Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

File created: C:\Users\user\AppData\Local\Temp\.squirrel-lock-91BF5AB5EAE066F2123B98CFB73D718F35147514

Jump to behavior

Source: classification engine

Classification label: clean10.winEXE@13/139@2/2

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: squirrel.exe	String found in binary or memory: Z) # Lookahead for non-space at line-start, or end of doc
Source: squirrel.exe	String found in binary or memory: squirrel-install
Source: squirrel.exe	String found in binary or memory: --squirrel-install
Source: squirrel.exe	String found in binary or memory: Update.exe not found, not a Squirrel-installed app?
Source: squirrel.exe	String found in binary or memory: a=\|process-start-args=
Source: squirrel.exe	String found in binary or memory: Failed to invoke post-install
Source: squirrel.exe	String found in binary or memory: --squirrel-install {0}

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\VisBridge

Jump to behavior

Source: VisBridge-1.0.4+Setup.exe

Static file information: File size 86984728 > 1048576

Source: VisBridge-1.0.4+Setup.exe

Static PE information: certificate valid

Source: VisBridge-1.0.4+Setup.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x52c8800

Source: VisBridge-1.0.4+Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: VisBridge-1.0.4+Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: VisBridge-1.0.4+Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: VisBridge-1.0.4+Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: VisBridge-1.0.4+Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: VisBridge-1.0.4+Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: VisBridge-1.0.4+Setup.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: VisBridge-1.0.4+Setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Users\ana\code\Squirrel\Squirrel.Windows\src\Setup\bin\Release\Setup.pdb source: VisBridge-1.0.4+Setup.exe, 00000000.00000000.259408108.0000000000B8E000.00000002.00020000.sdmp

Source: VisBridge-1.0.4+Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: VisBridge-1.0.4+Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: VisBridge-1.0.4+Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: VisBridge-1.0.4+Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: VisBridge-1.0.4+Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Code function: 23_2_01A22079 push ebx; retf		23_2_01A2207A
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Code function: 23_2_01A237C0 push esp; iretd		23_2_01A237C9

Source: VisBridge.exe.11.dr	Static PE information: section name: .00cfg
Source: VisBridge.exe.11.dr	Static PE information: section name: .retplne
Source: VisBridge.exe.11.dr	Static PE information: section name: .rodata
Source: VisBridge.exe.11.dr	Static PE information: section name: CPADinfo
Source: VisBridge.exe.11.dr	Static PE information: section name: _RDATA
Source: ffmpeg.dll.11.dr	Static PE information: section name: .00cfg
Source: ffmpeg.dll.11.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.11.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.11.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.11.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.11.dr	Static PE information: section name: _RDATA
Source: pepflashplayer.dll.11.dr	Static PE information: section name: .rodata
Source: pepflashplayer.dll.11.dr	Static PE information: section name: _RDATA

Source: VisBridge-1.0.4+Setup.exe	Static PE information: real checksum: 0x5303ef4 should be:
Source: pepflashplayer.dll.11.dr	Static PE information: real checksum: 0x1de0beb should be:
Source: VisBridge.exe.11.dr	Static PE information: real checksum: 0x75d3961 should be:

Source: d3dcompiler_47.dll.11.dr

Static PE information: 0xF3329C94 [Sat Apr 18 07:26:12 2099 UTC]

Persistence and Installation Behavior:

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe	File created: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\pepflashplayer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	File created: C:\Users\user\AppData\Local\VisBridge\Update.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\SquirrelTemp\SquirrelSetup.log			Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	File created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\SquirrelSetup.log			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe TID: 7016	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe TID: 2960	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe TID: 2960	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe TID: 5728	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\pepflashplayer.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Window / User API: threadDelayed 1780			Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Window / User API: threadDelayed 6904			Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File Volume queried: C:\Users\user\AppData\Roaming\VisBridge\Code Cache\js FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File Volume queried: C:\Users\user\AppData\Roaming\VisBridge\Code Cache\wasm FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File Volume queried: C:\Users\user\AppData\Roaming\VisBridge\blob_storage\3dfbf4c6-4e46-4287-a217-2afa53f94890 FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File opened: C:\Users\user\AppData\Local\VisBridge	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File opened: C:\Users\user\AppData\Local\VisBridge\app-1.0.4	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File opened: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	File opened: C:\Users\user\AppData	Jump to behavior

Anti Debugging:

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=gpu-process --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1448 /prefetch:2
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1812 /prefetch:8
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=gpu-process --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1448 /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1812 /prefetch:8	Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\Squirrel.exe' --updateSelf=C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --squirrel-install 1.0.4	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --squirrel-firstrun	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=gpu-process --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1448 /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Process created: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe 'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1812 /prefetch:8	Jump to behavior

Source: VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp

Binary or memory string: Shell_TrayWnd

Language, Device and Operating System Detection:

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe

Code function: 0_2_00B7B01B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00B7B01B

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter12	Windows Service1	Windows Service1	Masquerading1	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	DLL Search Order Hijacking2	Process Injection12	Disable or Modify Tools1	LSASS Memory	Query Registry1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	DLL Search Order Hijacking2	Virtualization/Sandbox Evasion22	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Virtualization/Sandbox Evasion22	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Timestomp1	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	DLL Search Order Hijacking2	DCSync	File and Directory Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery14	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
VisBridge-1.0.4+Setup.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	2%	ReversingLabs
C:\Users\user\AppData\Local\VisBridge\Update.exe	2%	ReversingLabs
C:\Users\user\AppData\Local\VisBridge\app-1.0.4\d3dcompiler_47.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\VisBridge\app-1.0.4\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\VisBridge\app-1.0.4\ffmpeg.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\VisBridge\app-1.0.4\libEGL.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\VisBridge\app-1.0.4\libGLESv2.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\pepflashplayer.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\pepflashplayer.dll	0%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://dns10.quad9.net/dns-query	0%	URL Reputation	safe
http://www.startssl.com/policy.pdf04	0%	URL Reputation	safe
https://doh.cleanbrowsing.org/doh/security-filter	0%	URL Reputation	safe
https://public.dns.iij.jp/	0%	Avira URL Cloud	safe
http://crl.startssl.com/sfsca.crl0f	0%	URL Reputation	safe
http://ocsp.rootg2.amazontrust.com08	0%	URL Reputation	safe
https://public.dns.iij.jp/dns-queryIijhttps://doh.opendns.com/dns-query	0%	Avira URL Cloud	safe
https://dns11.quad9.net/dns-query	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
https://scotthelme.report-uri.com/r/d/ct/reportOnly	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
https://public.dns.iij.jp/IIJ	0%	Avira URL Cloud	safe
https://cleanbrowsing.org/privacyCleanBrowsing	0%	Avira URL Cloud	safe
https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
http://www.startssl.com/policy0	0%	URL Reputation	safe
https://matteomarescotti.report-uri.com/r/d/ct/reportOnly	0%	URL Reputation	safe
https://dns.quad9.net/dns-query	0%	URL Reputation	safe
https://raw.githubusercontent.com/electron/electron/master/shell/browser/resources/win/electron.ico	0%	Avira URL Cloud	safe
https://doh.dns.sb/dns-query?no_ecs=true	0%	URL Reputation	safe
http://www.startssl.com/sfsca.crt0	0%	URL Reputation	safe
https://chrome-devtools-frontend.appspot.com/%s%s/%s/	0%	URL Reputation	safe
http://crl.rootg2.amazontrust.com/rootg2.crl0	0%	URL Reputation	safe
http://report-example.test/test	0%	URL Reputation	safe
https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query	0%	Avira URL Cloud	safe
http://www.startssl.com/sfsca.crl0	0%	URL Reputation	safe
https://public.dns.iij.jp/dns-query	0%	Avira URL Cloud	safe
http://o.ss2.us/0	0%	URL Reputation	safe
http://aia.startssl.com/certs/ca.crt02	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://ocsp.entrust.net00	0%	URL Reputation	safe
http://crt.rootg2.amazontrust.com/rootg2.cer0=	0%	URL Reputation	safe
https://dns.google/dns-query	0%	URL Reputation	safe
http://ocsp.thawte.com0;	0%	Avira URL Cloud	safe
http://subca.ocsp-certum.com0.	0%	URL Reputation	safe
https://chrome-devtools-frontend.appspot.com/	0%	URL Reputation	safe
http://subca.ocsp-certum.com01	0%	URL Reputation	safe
http://s../../net/third_party/quiche/src/quic/core/crypto/certificate_view.ccInvalid	0%	Avira URL Cloud	safe
https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11h	0%	Avira URL Cloud	safe
https://www.quad9.net/home/privacy/Quad9	0%	Avira URL Cloud	safe
http://s../../net/third_party/quiche/src/quic/core/crypto/certificate_view.cc	0%	Avira URL Cloud	safe
http://s.ss2.us/r.crl0	0%	URL Reputation	safe
https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10	0%	Avira URL Cloud	safe
https://doh.cleanbrowsing.org/doh/family-filter	0%	URL Reputation	safe
https://cleanbrowsing.org/privacy	0%	Avira URL Cloud	safe
https://log.getdropbox.com/hpkp	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.gtlvisitme.com	38.90.155.59	true	false		unknown
raw.githubusercontent.com	185.199.108.133	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/electron/electron/master/shell/browser/resources/win/electron.ico	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/myuser/myrepo	Update.exe, 0000000B.00000000.307764115.00000000009A2000.00000002.00020000.sdmp, squirrel.exe	false		high
http://ocsp1.wosign.com/ca104	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://dns10.quad9.net/dns-query	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://www.startssl.com/policy.pdf04	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
https://doh.familyshield.opendns.com/dns-query	VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://ocsp1.wosign.com/ca108	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://doh.cleanbrowsing.org/doh/security-filter	VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.starfieldtech.com/08	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://public.dns.iij.jp/	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.starfieldtech.com/0;	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://crl.startssl.com/sfsca.crl0f	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://repository.certum.pl/ca.cer09	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://ocsp.rootg2.amazontrust.com08	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://crl.godaddy.com/gdig2s5-6.crl0	VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp	false		high
https://public.dns.iij.jp/dns-queryIijhttps://doh.opendns.com/dns-query	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://crls1.wosign.com/ca1.crl0q	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://dns11.quad9.net/dns-query	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://www.certplus.com/CRL/class2.crl0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://scotthelme.report-uri.com/r/d/ct/reportOnly	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
https://clients3.google.com/ct_upload	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://crl.thawte.com/ThawtePremiumServerCA.crl0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://certificates.godaddy.com/repository/gdig2.crt0	VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp	false		high
http://www.entrust.net/rpa0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://www.certum.pl/CPS0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://dns.switch.ch/dns-query	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://cps.root-x1.letsencrypt.org0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
https://public.dns.iij.jp/IIJ	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://l.twimg.com/i/hpkp_report	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://cleanbrowsing.org/privacyCleanBrowsing	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.certum.pl/ctnca.crl0k	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://certs.godaddy.com/repository/1301	VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp, VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://www.alphassl.com/repository/03	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://developers.google.com/speed/public-dns/privacyGoogle	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://chrome.cloudflare-dns.com/dns-queryone.one.one.one1dot1dot1dot1.cloudflare-dns.com1.1.1.11.0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
https://api.github.com/#	Update.exe, 0000000B.00000000.307764115.00000000009A2000.00000002.00020000.sdmp, squirrel.exe, 00000017.00000002.515630470.0000000000DF2000.00000002.00020000.sdmp	false		high
https://doh.opendns.com/dns-query	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.startssl.com/policy0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
https://matteomarescotti.report-uri.com/r/d/ct/reportOnly	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
https://certs.godaddy.com/repository/0	VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp, VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://dns.quad9.net/dns-query	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://certificates.godaddy.com/repository/gd_intermediate.crt0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://www.symauth.com/cps0(	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://www.thawte.com/cps0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://doh.dns.sb/dns-query?no_ecs=true	VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://www.startssl.com/sfsca.crt0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://crl.godaddy.com/gdroot-g2.crl0F	VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp, VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://chrome-devtools-frontend.appspot.com/%s%s/%s/	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://crl.rootg2.amazontrust.com/rootg2.crl0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only#	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://report-example.test/test	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa0)	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://dns.sb/privacy/DNS.SBhttps://doh.dns.sb/dns-query	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://odvr.nic.cz/dohodvr.nic.cz185.43.135.12001:148f:fffe::1	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://www.startssl.com/sfsca.crl0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa00	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://public.dns.iij.jp/dns-query	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://o.ss2.us/0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://aia.startssl.com/certs/ca.crt02	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0;	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://api.github.com/	squirrel.exe	false		high
https://certs.starfieldtech.com/repository/0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://ocsp.entrust.net03	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://certificates.godaddy.com/repository/0	VisBridge-1.0.4+Setup.exe, 00000000.00000003.292275214.00000000065B6000.00000004.00000001.sdmp, Update.exe, 0000000B.00000003.310854395.000000000120A000.00000004.00000001.sdmp	false		high
http://ocsp.entrust.net02	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net00	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
https://dns.switch.ch/dns-querydns.switch.ch130.59.31.251130.59.31.2482001:620:0:ff::22001:620:0:ff:	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://crt.rootg2.amazontrust.com/rootg2.cer0=	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://clients3.google.com/cert_upload_json	VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://aia1.wosign.com/ca1-class3-server.cer0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://dns.google/dns-query	VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://certificates.godaddy.com/repository100.	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://crl.thawte.com/ThawtePCA-G3.crl0	VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://ocsp.thawte.com0;	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	low
http://subca.ocsp-certum.com0.	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/Cloudflare	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://www.wosign.com/policy/0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://chrome-devtools-frontend.appspot.com/	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
https://developers.google.com/speed/public-dns/privacy	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://crl.entrust.net/g2ca.crl0;	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://subca.ocsp-certum.com01	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://s../../net/third_party/quiche/src/quic/core/crypto/certificate_view.ccInvalid	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	low
https://dns11.quad9.net/dns-querydns11.quad9.net9.9.9.11149.112.112.112620:fe::112620:fe::fe:11h	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.quad9.net/home/privacy/Quad9	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://s../../net/third_party/quiche/src/quic/core/crypto/certificate_view.cc	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	low
http://s.ss2.us/r.crl0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
https://dns10.quad9.net/dns-querydns10.quad9.net9.9.9.10149.112.112.102620:fe::102620:fe::fe:10	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://odvr.nic.cz/doh	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://repository.certum.pl/ctnca.cer09	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://doh.cleanbrowsing.org/doh/family-filter	VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
https://doh.xfinity.com/dns-query	VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
https://cleanbrowsing.org/privacy	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://log.getdropbox.com/hpkp	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown
http://certs.starfieldtech.com/repository/1402	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://crl.starfieldtech.com/sfroot-g2.crl0L	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false		high
http://ocsp.thawte.com0	VisBridge.exe, 00000018.00000000.465002831.00007FF7BE2EB000.00000002.00020000.sdmp, VisBridge.exe, 0000001B.00000000.498808205.00007FF7BE2EB000.00000002.00020000.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.199.108.133	raw.githubusercontent.com	Netherlands		54113	FASTLYUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	499619
Start date:	08.10.2021
Start time:	17:26:57
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	VisBridge-1.0.4+Setup.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean10.winEXE@13/139@2/2
EGA Information:	Successful, ratio: 33.3%
HDC Information:	Successful, ratio: 1.2% (good quality ratio 0.7%) Quality average: 39.2% Quality standard deviation: 41.6%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 95.100.218.79, 95.100.216.89, 20.50.102.62, 209.197.3.8, 20.199.120.182, 2.20.178.24, 2.20.178.33, 52.251.79.25, 20.54.110.249, 40.112.88.60, 20.199.120.151, 142.250.203.110, 74.125.8.105 Excluded domains from analysis (whitelisted): consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, r4---sn-5hne6nzs.gvt1.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, redirector.gvt1.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, eus2-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, r4.sn-5hne6nzs.gvt1.com Execution Graph export aborted for target VisBridge-1.0.4+Setup.exe, PID 3260 because there are no executed function Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found. Too many dropped files, some of them have not been restored VT rate limit hit for: /opt/package/joesandbox/database/analysis/499619/sample/VisBridge-1.0.4+Setup.exe

Simulations

Behavior and APIs

Time	Type	Description
17:29:21	API Interceptor	81x Sleep call for process: Update.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
185.199.108.133	ShippingDocs.exe	Get hash	malicious	Browse
	WAXE8BB.exe	Get hash	malicious	Browse
	d9cA4ZayfI	Get hash	malicious	Browse
	Rbixyh6r8R.exe	Get hash	malicious	Browse
	51490_Video_Oynat#U0131c#U0131.apk	Get hash	malicious	Browse
	94270_Video_Oynat#U0131c#U0131.apk	Get hash	malicious	Browse
	75041_Video_Oynat#U0131c#U0131.apk	Get hash	malicious	Browse
	26574_Video_Oynat#U0131c#U0131.apk	Get hash	malicious	Browse
	rwqGxFrXrc.exe	Get hash	malicious	Browse
	Exodus.exe	Get hash	malicious	Browse
	CxarNMwOrM.exe	Get hash	malicious	Browse
	63952_Video_Oynat#U0131c#U0131.apk	Get hash	malicious	Browse
	63952_Video_Oynat#U0131c#U0131.apk	Get hash	malicious	Browse
	DHL QA-Tracker.doc	Get hash	malicious	Browse
	W2FDqQa9Da.exe	Get hash	malicious	Browse
	WDDzCTWnXh.exe	Get hash	malicious	Browse
	VQDRiGUCxq.exe	Get hash	malicious	Browse
	47A55E678C1C05D11445BEEBB73E5822625663C107214.exe	Get hash	malicious	Browse
	tt08hBCPjG.exe	Get hash	malicious	Browse
	setup_x86_x64_install.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
raw.githubusercontent.com	M0y2otz1JB.exe	Get hash	malicious	Browse	185.199.108.133
	cFjtsk0IBh.exe	Get hash	malicious	Browse	185.199.108.133
	1xAO2Lh53a.exe	Get hash	malicious	Browse	185.199.108.133
	s6NlcWOh8S.exe	Get hash	malicious	Browse	185.199.111.133
	a6khtecd4C.exe	Get hash	malicious	Browse	185.199.109.133
	fWbvwloyNp.exe	Get hash	malicious	Browse	185.199.109.133
	34BUWCT7QV.exe	Get hash	malicious	Browse	185.199.111.133
	VQDRiGUCxq.exe	Get hash	malicious	Browse	185.199.108.133
	XGYiud4T6T.exe	Get hash	malicious	Browse	185.199.108.133
	Z3CkP5Pboa.exe	Get hash	malicious	Browse	185.199.108.133
	details.pdf.vbs	Get hash	malicious	Browse	185.199.111.133
	SecuriteInfo.com.Trojan.GenericKD.46968833.5808.exe	Get hash	malicious	Browse	185.199.110.133
	tt08hBCPjG.exe	Get hash	malicious	Browse	185.199.108.133
	2M7Tc1ZArj.exe	Get hash	malicious	Browse	185.199.108.133
	mjqy4zE4oU.exe	Get hash	malicious	Browse	185.199.108.133
	fIlUUmpx1U.exe	Get hash	malicious	Browse	185.199.111.133
	chrome_setup.exe	Get hash	malicious	Browse	185.199.109.133
	vNL3kZiZZ0.exe	Get hash	malicious	Browse	185.199.108.133
	e4lfaIwvwz.exe	Get hash	malicious	Browse	185.199.108.133
	KlErfuBsH2.exe	Get hash	malicious	Browse	185.199.108.133

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
FASTLYUS	mixsix_20211008-150045.exe	Get hash	malicious	Browse	185.199.111.154
	Purchase Order PO000037189.xls.html	Get hash	malicious	Browse	199.232.136.157
	Quotation.jar	Get hash	malicious	Browse	199.232.192.209
	PO 870EW3144.jar	Get hash	malicious	Browse	199.232.192.209
	Hyland Atlantic Health Eic BLOB Cleanup V 1.0.docx	Get hash	malicious	Browse	199.232.136.157
	ShippingDocs.exe	Get hash	malicious	Browse	185.199.108.133
	c9.dll	Get hash	malicious	Browse	151.101.1.44
	a04.dll	Get hash	malicious	Browse	151.101.1.44
	TS49YVEABV.html	Get hash	malicious	Browse	151.101.112.193
	WAXE8BB.exe	Get hash	malicious	Browse	185.199.108.133
	TsozeiN4tT.dll	Get hash	malicious	Browse	151.101.1.44
	3JWv5bYojD.dll	Get hash	malicious	Browse	151.101.1.44
	3JWv5bYojD.dll	Get hash	malicious	Browse	151.101.1.44
	Invoice.xlsx	Get hash	malicious	Browse	151.101.112.193
	Invoice.xlsx	Get hash	malicious	Browse	151.101.112.193
	yMPBuPqE33.dll	Get hash	malicious	Browse	151.101.1.44
	cs.exe	Get hash	malicious	Browse	151.101.18.62
	1xjJ6fFB1b.dll	Get hash	malicious	Browse	151.101.1.44
	TooltabExtension.dll	Get hash	malicious	Browse	151.101.1.44
	jqzMAYCER2.dll	Get hash	malicious	Browse	151.101.1.44

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Squirrel.exe.log Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1265
Entropy (8bit):	5.340171064243184
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKh7E4O1lEE4UVwuE4IWUAE4KI6ns:MxHKXwYHKhQno7HKlEHU5HIW7HKjs
MD5:	2B685AA47865989751DE7902665B5087
SHA1:	DCB3866EB74BADD6BB666D7AF77D400DE737B78D
SHA-256:	E759F970EE1AEFCDDB619CDE7597128332F2C4F90E3A02E789788A184E59BC92
SHA-512:	DC6842C3B2694B844D2351A3D500CF007E63D73251D44960F7EAF69A13CCDD1C17C758FE78F79E235ED9C69141769C704B1223B726CBFF739D1FFB2FC1D510F2
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\SquirrelTemp\RELEASES Download File
Process:	C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe
File Type:	UTF-8 Unicode (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.859310698323247
Encrypted:	false
SSDEEP:	3:iWTQLdOgxWjer/LrGTzdn:H8WijGTx
MD5:	F932F5FA861E01D175FE247730F5B120
SHA1:	23FD85E3D0B9B80B9EACB2647A5564C92C059140
SHA-256:	E6F4B8ACBCE1A0C91B50829C77D3364B3F682E8FA31BFC0B0AA40C3E03FDAB84
SHA-512:	9B5C38AC10F26EEA8F4209EBBAA1F84A8FD0C16826518507A61B1CF6E9198A5C72F1BF78352B4B26F6724F2E3B5BCC741B9022F1496C7DEDE0D0045092719B05
Malicious:	false
Reputation:	unknown
Preview:	.B409029996343C5B19AA9CFD7B18BCDDED443F26 VisBridge-1.0.4-full.nupkg 86206808

C:\Users\user\AppData\Local\SquirrelTemp\SquirrelSetup.log Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2752
Entropy (8bit):	5.208769188734254
Encrypted:	false
SSDEEP:	48:ED/AZLT7hgcpJZVWgBNNXzHSxBNN4zvIbIWzlGAgATQn0pJ2VWgBNNXzHSxBPdRG:iygk38lRLFLS8xen
MD5:	DF797A834FB3793ADEFE313B3EC58366
SHA1:	80CBA8B552A1C111D5827D775C6076029730A4B2
SHA-256:	AC69EC242CBB9CEB0C1EA9CE81E2F4BEFE4B3A190863066FA7766056F40AE7AB
SHA-512:	CBC3350D1301EC51F69AE26346F11FD8305B239C14E4891A4932AE78FE56758EE27FE9A05216039A455EAFB5561D3973B2151B8D18940F507574A05F641D129E
Malicious:	false
Reputation:	unknown
Preview:	.2021-10-08 17:28:25> Program: Starting Squirrel Updater: --install ...2021-10-08 17:28:25> Program: Starting install, writing to C:\Users\user\AppData\Local\SquirrelTemp..2021-10-08 17:28:25> Program: About to install to: C:\Users\user\AppData\Local\VisBridge..2021-10-08 17:28:26> CheckForUpdateImpl: Couldn't write out staging user ID, this user probably shouldn't get beta anything: System.IO.DirectoryNotFoundException: Could not find a part of the path 'C:\Users\user\AppData\Local\VisBridge\packages\.betaId'... at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath).. at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost).. at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize,

C:\Users\user\AppData\Local\SquirrelTemp\Update.exe Download File
Process:	C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1830120
Entropy (8bit):	5.886179785302717
Encrypted:	false
SSDEEP:	24576:1NMFwWMK8zptHroPjSWijyJsVB3Fm27jmHxefUFU7+KgJhzV31s66:pWfqoPj6cxefUFU5gJhtg
MD5:	C45A02058073AEB5783F40F78CBF6130
SHA1:	559D64954F25355775E44708C83CC231B042ABF9
SHA-256:	B353A149830EBBB9DD6F0B277F399F489B604C0224448F6300D64EF6162B0073
SHA-512:	DDA56D82B516292FE3CDB9F61069C7216361AC68864161119B0F454B0D258451CDBE1F94F73033EE90C5EF3214B8CA97C61475F1EC103D379C92FA5BBBEAA638
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\\................................. ........@.. .......................@.......+....@.....................................W............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......@...D.............................................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... .A. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X*..0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....%..{......................

C:\Users\user\AppData\Local\SquirrelTemp\VisBridge-1.0.4-full.nupkg Download File
Process:	C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	86206808
Entropy (8bit):	7.997914386294035
Encrypted:	true
SSDEEP:	1572864:V5dzV9dD6WVlrj2szPiLh4R2Z3S7BQKwhiXWU4+D3ztxEKrIqAe+:V5fjFdxzPU4RwMfwhimgD3znFrwe+
MD5:	070CA605F2C06710E83C21B29B786499
SHA1:	B409029996343C5B19AA9CFD7B18BCDDED443F26
SHA-256:	BD373CB5E6AA47D876C8A436F5D4C6FF5A54BB99685F0BC57AF4FB3319B7CDE1
SHA-512:	62CE2D551A0C63297CF58FB4E4860A697A0BF7C9928B225F017E77CC2C97D952B5D125D3305D2FB23C5E99F5ADDCD7565F664FEEF730FB3474B6231E618C1036
Malicious:	false
Reputation:	unknown
Preview:	PK........"..Q................lib/PK........$..Q................lib/net45/PK........#..Q.J.....r... ...lib/net45/chrome_100_percent.pak..uTTQ....-.]..))...>.$.....D@$.F....n...T.nX.iD:fg{....{.3...}3o.=_....,...=..(.i......'.aN...+... B....H.6.........8O.@.b.).......).R...x....E'....g..HW.d. K....lEg6......(R\|..@.b.8.%......I.`..P..#uGi...d.0Q....T....9...\|P.Q. W.[..<.1u.....P.n...9.74.(S...\=4....$...E...PJ..VPR....h9.6....[...{................W....I....i.^Ad.......p.H....:....R>...!O...(....0.0..u........!&B...p.a ..'..Ph..0..%..C.T0.....@$.K..QP!...'#..B.L0..I..@"....I.....A..0..eJ.@&$'..Y.$....sY..8.....W..r.`4. .<..C.h.@..0P.I.@..s....m4K..{0P..+.@..Q...;.a..Bi.@%....UP...TCI.a.....ZHQ... }........<..OP.!.4A!.0...%.@.D...Z..4..d.h.pwa..T.....q8.tA..p..IG.A.T.f/....}P....Z...@d.p0..9.....0.$..F ..8..M...JK..Q.i........!.d8..dS.`..M..i.n&.. xr.`....b..y.[.., :.\Dl.....s..,#0..`.......? .......5.f...#$j.`.Q..O.D-.l">...P...m...;..z8.El...p......4.!.?..!"....4..

C:\Users\user\AppData\Local\SquirrelTemp\background.gif Download File
Process:	C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe
File Type:	GIF image data, version 89a, 268 x 167
Category:	dropped
Size (bytes):	44410
Entropy (8bit):	7.7070750223988425
Encrypted:	false
SSDEEP:	768:5XxIn344C+JtOb7Q+8Phv9YaZuJ+Hz7X9Dbzjy2CXdSksvlxkZPbM/zEffvTeq6e:5XxIn344C+Jty7Q+8Phv9YaZuJ+Hz7Xk
MD5:	B5A42ECDE0B058B3C4E661E0EC84400B
SHA1:	7E2BFC653C5BC6997553C150A0823DAAE372CD99
SHA-256:	CE636D201EF86FFBF4EE8C8762B4D9DC255BE9D5F490D0A22E36FE0C938F7244
SHA-512:	B7F4A7BDDB226066F7EDF23DFB9BEE658C30AE03DFE727EC739F51FD98C63831F732343C14A6CA080F31BAED38BF9064CDD57C9D1DAAF4C42C029FE83D846DC0
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.....'.u.X....g...fc....k....c.....\|..x..N.r..h....a..S.vQ.z..0RI.......wvU...............~......mm.....J~o.............................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5bd1a3f9-b85a-4eb9-85dc-c23747faf8bc" xmpMM:DocumentID="xmp.did:D8E6E3A75EC811E3923FAFD028B2BCD6" xmpMM:InstanceID="xmp.iid:D8E6E3A65EC811E3923FAFD028B2BCD6" xmp:CreatorTool="Adobe Photoshop CC (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:f301f6f3-cbb3-43a5-9231-942166c2ce37" stRef:documentID="xmp.did:5bd

C:\Users\user\AppData\Local\VisBridge\Update.exe Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1830120
Entropy (8bit):	5.886179785302717
Encrypted:	false
SSDEEP:	24576:1NMFwWMK8zptHroPjSWijyJsVB3Fm27jmHxefUFU7+KgJhzV31s66:pWfqoPj6cxefUFU5gJhtg
MD5:	C45A02058073AEB5783F40F78CBF6130
SHA1:	559D64954F25355775E44708C83CC231B042ABF9
SHA-256:	B353A149830EBBB9DD6F0B277F399F489B604C0224448F6300D64EF6162B0073
SHA-512:	DDA56D82B516292FE3CDB9F61069C7216361AC68864161119B0F454B0D258451CDBE1F94F73033EE90C5EF3214B8CA97C61475F1EC103D379C92FA5BBBEAA638
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\\................................. ........@.. .......................@.......+....@.....................................W............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......@...D.............................................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... .A. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X*..0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....%..{......................

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\LICENSE Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	5.124434796745036
Encrypted:	false
SSDEEP:	24:VDiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:VDiJzfPvGt7ICQH+sfIte36AFD
MD5:	45574510C534A8195F53B30E3810239E
SHA1:	10BFA95A2F25DF14DFE6A55A9E73D9FA5BECDB60
SHA-256:	C44607A865E7A6DB05552BAA0EF71F9887D96ACD00D123854B44996BC27C0E33
SHA-512:	B59D4C8E07748B68DA51B2163A2EBAFD51CDC546A1776A1105C19F6727DAD697692D4FCB137578BB43DC615342A08C2E9E103384B80FC81C3C669AECC9C443C8
Malicious:	false
Reputation:	unknown
Preview:	Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION.WITH

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\SquirrelSetup.log Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	196
Entropy (8bit):	5.115936780987772
Encrypted:	false
SSDEEP:	3:O1LdFxQEBM2F2UZHsOBEREIqANLWO0nacwRE2J52U5sMyYpi1LdFxsMXFtlU1K:idFSVUB4hqiL1cNwi232UydFZt
MD5:	727EDB3BF1D777CC3A48A673BD624AE3
SHA1:	BCCA2735D99D73BF3A06AD16162DC0040656317D
SHA-256:	3C01C5114B915AC73E2DC45B2AA44136B24BFB1192A7C9420CDF3C06C6F2ACB2
SHA-512:	F339ED4EC597C0B1FE11F655AC0C7BB9825C3EEFAA3BADAF686C247D292F030357B10FC612DA962DAED0319A33693615788C2899416DAFCDE22150485668AB19
Malicious:	false
Reputation:	unknown
Preview:	.2021-10-08 17:29:21> Program: Starting Squirrel Updater: --updateSelf=C:\Users\user\AppData\Local\SquirrelTemp\Update.exe..2021-10-08 17:29:21> Program: About to wait for parent PID 6888..

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	76677120
Entropy (8bit):	6.472286092716795
Encrypted:	false
SSDEEP:	786432:jidzCEXJ1ygeL7g6zRBPd6nShjXWm19CELXwZp7cDd/DC:jidzDXWP7g6zRByS9LnLgZNcRLC
MD5:	B2106517AA8D0A9519851F425F432EA3
SHA1:	244B531F1B1DE508907B105053484AEC86CC37C8
SHA-256:	A24D656946A2A8EF8130939E7E505C5338CEC88C438C838FC99B45E5F04A4E44
SHA-512:	A8AFEC38C54A87C415437E940BD503DD13C76EB04ED6F8335F31106F60339B80AC0E24EE25DAC07B9AF5C6F42C94684FB3ADF2829947645711A8D81F8A8ABC79
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...p.._.........."..........:N.....0..........@....................................a9]...`.........................................^...........h............PV.`.+...\...... ..t....D......................p?..(...p...0...........8...........`....................text.............................. ..`.rdata..._.......`..................@..@.data....3;.........................@....pdata..`.+..PV...+... .............@..@.00cfg..(.... .......nL.............@..@.retplneT....0.......pL..................rodata......@.......rL............. ..`.tls.........`........L.............@...CPADinfo8....p........L.............@..._RDATA................L.............@..@.rsrc.................L.............@..@.reloc..t.... ........P.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\chrome_100_percent.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	180594
Entropy (8bit):	7.841177755114997
Encrypted:	false
SSDEEP:	3072:IDKzwVbpDhO54UCZIQ2w5+vfdYCJdx10khejSTS9SO0vVm7O0U27IIABNHlJMgfI:IDKzwVXOHCZ3x5c1YC7x10fSucY7OP2j
MD5:	D5719B1F791AC999C3CFDA2E4405BDCE
SHA1:	C5D94054BCB271DEE08714C313476ABD67BE28CA
SHA-256:	7CB9D93A16E5621AB765E3F3B459F4698AE496035E283F2C0C390B188A487741
SHA-512:	CE75BDE78DDF6BC394662C5D0CE107BA375B13BF75A31BA1888DFFA74900FA86BABD65CE222C38DB73A11C8D54B3C6F6046B8F71CE80281EEC884FD7F0CD1583
Malicious:	false
Reputation:	unknown
Preview:	..................#.....:.q....A.....A^....A.....AK....A.....A.....A.....A<....A6....Aq....A.....A. ...A.!...Ar#...A.$...Ak-...A.5...A.7...Aa8..\IO9..]Ip:..^I0<.._I.?..`I.B...I.E...I.F...I~H...I.I...I.J...IhK...I.L...I-....I....dP_...ePd...fP....gP....hP...iP....jPl...mP....nP....oPv...pP....qP....rP....sP....uP....wP....yP....zPE....P.....P.....P.....P.....P.....P.....P.....P-....P.....P.....P.....P.....P.....P.....P&....P.....P7 ...P.!...P;%...P.&...P.7...P>8...PP:...Pe<...P&=...P.>...P.>...P.?...P.?...Pc@...P8A...P.B...P.B...P.C...P^E...P.G...P=J...P.N...P.S...P.T...P.U...PlV...PAW...P.X...P.X...P.Z...P.\...P.^...PH....P.....P....P.....P.....P.....P.....P....P:....P.....P ....P.....PH....P.....P....P.....PZ....P.....P....P.....P[....P.....PF....P<....P3....PB....R....Rv....R....R#....R....R....R.....R.....RV....R.....R....R9....RM....R7....R.....R7....R.....RD....R....R]....R....Rx....R....R1....R.....R....R.....R.....R`....R....R....Rw....R....RO....R.....R.....R\|.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\chrome_200_percent.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	320847
Entropy (8bit):	7.924574929324259
Encrypted:	false
SSDEEP:	6144:0rDQYak+9bMOHCZLz73QYV85u/oFYvwoytKi6obByPGlPFYKyo+:0YfzEg5u/oFFpxLlFYZ
MD5:	0649DF49260E18326C9A54545131AAEC
SHA1:	76DE40E3B828CB42CB8B9BEB31808EA2145EDA56
SHA-256:	070A6CB68318A032EC17CD7B07F8AF8BD6983F16997F50A231D232396A2F570F
SHA-512:	C196726564EA218C1E58121F43AB6F138A676A47CD53AD9099DAEC4CC3A491CF7F9127C56F31F8EC460080BA5F2F56EB2F6C7D37E286E05C4DBD9592552185D4
Malicious:	false
Reputation:	unknown
Preview:	..................#.....:......A&....A5....A.....A.....A.....A.....A.%...A.+...A!....A.5...A.9...A&<...A.=...A.A...A.A...A'V...AGh...A\|m...A7n..\Ixo..]Ics..^I.v.._I.y..`I.\|...I\....In....I.....IT....IG....I....I.....I.....I....dP....eP....fP....gP....hP....iPN...jP....mP....nPp...oP....pPi...qP]...rP'...sP....uP....wP."..yP.&..zP$1...Pk5...P.7...P.@...P.H...P.J...P.M...P.Q...P.Y...P.Z...P.^...Pnb...PUf...P l...P.m...P.p...P4s...P\v...P.y...P!....P.....P.....P.....P.....P.....P.....P....P....P.....P.....P-....P.....P ....P.....Pp....P.....P.....P.....P.....Ph....P.....P$....P.....P.....P>....P.....Pd....PQ....P.....Pv....P.....P5....PT`...P.a...P.b...PBd...P.....P`....P.....P.....P<....P.....P....P.....P.....P.....P....P....P....P....P.....P$....PE....P9....P.....P....Po....PD....RI....R.....R.....Rf....R.....RG....R ....Rv....R.....R4....R.....R.....R.....R.....R}....R.....R.....R/....R.....R`....R.....R.....R.....R.....R[....R.....Rv....R7....R.....R5....R.....R/....R.....RO.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\d3dcompiler_47.dll Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4524696
Entropy (8bit):	6.367051782021837
Encrypted:	false
SSDEEP:	49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
MD5:	7641E39B7DA4077084D2AFE7C31032E0
SHA1:	2256644F69435FF2FEE76DEB04D918083960D1EB
SHA-256:	44422E6936DC72B7AC5ED16BB8BCAE164B7554513E52EFB66A3E942CEC328A47
SHA-512:	8010E1CB17FA18BBF72D8344E1D63DED7CEF7BE6E7C13434FA6D8E22CE1D58A4D426959BDCB031502D4B145E29CB111AF929FCBC66001111FBC6D7A19E8800A5
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S........................................a.............................................................................Rich....................PE..d.....2..........." ......3.........0.&.......................................E.....VTE...`A..........................................A.x.....A...... E.@.....B..!....D.."...0E....P.>.T....................{7.(...pz7..............{7..............................text...D.3.......3................. ..`.rdata........3.......3.............@..@.data....#....A.......A.............@....pdata...!....B.."...>B.............@..@.rsrc...@.... E......`D.............@..@.reloc......0E......fD.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\ffmpeg.dll Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2815720
Entropy (8bit):	6.614537805087733
Encrypted:	false
SSDEEP:	49152:CVtTXiHnB+JD20P2jtEkt1HTSPSbVfhOfs9XOee7dhljxwELGpCWCcnYhpZ6ozHm:CHiUJRu1ELYnYaaXkv
MD5:	72A2B9FBF0DFD2D692D5E19440FC1759
SHA1:	282D306CBEF728750332B5E46B048080D8205AA3
SHA-256:	DBB66FCF59B5585ED53842E4C749468890B6EA0FA2235901457C006A26F875AA
SHA-512:	456A3DDFF36935891A617851347AD1F85BEA08265D01C9D8209B4CD83BAD5902CEDAD9C48719B4FA471D88A0E08491604A254FDA13B48CAB85F12B2942141F39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...p.._.........." ......"..b.......w.......................................0=......>+...`.........................................p').....3-).(.............<.4............<..6..t&)......................$).(.....(.0............0).0............................text...6."......."................. ..`.rdata..d7...."..8....".............@..@.data...."....)..D....).............@....pdata..4.....<....................@..@.00cfg..(.....<....................@..@.tls..........<....................@..._RDATA........<....................@..@.reloc...6....<..8.................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\icudtl.dat Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	10518160
Entropy (8bit):	6.2302696739268475
Encrypted:	false
SSDEEP:	196608:Ub+wSv9AAQbNjliXUxR0rHf93WhlA6tj1w:U5KlQbBliXUxR0rHf93WhlA6tj+
MD5:	9732E28C054DB1E042CD306A7BC9227A
SHA1:	6BAB2E77925515888808C1EF729C5BB1323100DD
SHA-256:	27993E2079711D5F0F04A72F48FEE88B269604C8E3FBDF50A7F7BB3F5BFC8D8E
SHA-512:	3EB67AB896A56DAB4A2D6EEA98F251AFFD6864C5F5B24F22B61B6ACC1DF4460D86F0A448F1983AAC019E79FF930286C3510891BE9D48EF07A93FF975A0E55335
Malicious:	false
Reputation:	unknown
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .2....A.......A.......A.......A.......A..0....A.......A...%...B...&.. B..`&..0B..Pk..DB...k..WB...l..jB...m..}B..`m...B...o...B..po...B...o...B..0p...B...p...B.. r...C..ps...C...t..(C..`t..;C...u..NC...v..aC..`x..tC...z...C..pz...C...{...C.. \|...C...}...C..p}...C...}...C..P~...D.......D......2D......ED......VD..`...jD......zD.......D..p....D..p....D.......D.......D..`....D.......E.......E..P.../E......?E..@...RE......iE......yE.......E..@....E.......E.......E..0....E.. ....E..`Z...F....&./F....&.FF..P.&.]F..@.'.wF....'..F....'..F....'..F..p.'..F....'..F....(..G..PM).(G.....GG..p..iG..p.+..G...7,..G....,..G....,..G....,..G....,..H..`.,.*H....-.FH...&..dH....0.}H.. .0..H..0.0..H..@.0..H....0..H....0..H....0..I..P.0..I....0.-I....0.=I..p.1.PI....1.cI....1.vI..`.1..I....1..I....1..I..`.1..I..P.1..I...31..I...51..J....1..J..@.1./J.. .1.DJ..0.1.YJ..

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\libEGL.dll Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	442088
Entropy (8bit):	6.293643898878802
Encrypted:	false
SSDEEP:	6144:FY9Lb+XOh+hzKL+ptr9kDMp6pd4JIXOiVc:FILb+XOhGKLq4d4JIX5c
MD5:	5E2177192D287234220E22D341C05718
SHA1:	BFD2FFB039ACBA887A97C2504B7FABB47F2A482D
SHA-256:	3A2D10B10F19CCE59BCCB5CD761161E0489B6C13F34BE0E44000D5D5E6BEBEAC
SHA-512:	A72F714954A19D7800218EDFAE18380E3F2CE594B964B544027185C32F8F92225805F4244DC3BD2BAB50103A6B0D5520860C2B4BC529DCF28942081D53CD6D1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...p.._.........." .................j.......................................0.......?....`.........................................X.......E...(....... ........<........... ......t..........................(.......0...........P................................text............................... ..`.rdata..............................@..@.data....L...P... ...:..............@....pdata...<.......>...Z..............@..@.00cfg..(...........................@..@.tls................................@..._RDATA..............................@..@.rsrc... ...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\libGLESv2.dll Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9662696
Entropy (8bit):	6.290273344437268
Encrypted:	false
SSDEEP:	98304:b4lfzYMbCZTXEalBkICxa8WGyWhk0P93Z:b4lfzYMWflBkI6a8WKy09Z
MD5:	853691EE18BC309F46649B5163D4F80D
SHA1:	92790BC1FBCF057719EAC28DC7847DEA601CAC6A
SHA-256:	73D573F0756BDAED37549500364D5F78D969B1DC672923ADB062FB0D5306B10B
SHA-512:	2220666A6EFAB2C9640D4FFDC6F6B200E3188E549CD99D61C749700CC1C5B0069654BCFCAC9C462678AA41E922CF66D5F7480D1D0C168F2729ACE1129E87FB34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...p.._.........." ......l...&.......i...................................... ...........`.........................................-..........d.......p....P...R...d..........h/..L.........................(.......0..................P..@....................text.....l.......l................. ..`.rdata........l.......l.............@..@.data.....d......$..................@....pdata...R...P...T.................@..@.00cfg..(............(..............@..@.tls.................*..............@..._RDATA...............,..............@..@.rsrc...p...........................@..@.reloc..h/.......0...4..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\am.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	140647
Entropy (8bit):	5.043381693262826
Encrypted:	false
SSDEEP:
MD5:	587EF55BC43FE3ABC9EBD8388690183B
SHA1:	DADD41EA934E10391BF93869805524B676CF35C2
SHA-256:	FDCCEDDC2A8684DEC0C5C2DB5296A308603F371EB6C65B6F5C76754B1801462F
SHA-512:	DB75A55620367E89446E517A98FDE821E1E2D599FAFD5EAA6B103D443BD58D27AC33C62FC5A5496EBE2823C66703D289427DC4F8098A6DAD3F251EE3B392D6A8
Malicious:	false
Reputation:	unknown
Preview:	........m...j..0..k.#0..l..0..n.60..o.;0..p.H0..q.N0..r.]0..s.n0..t.w0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....1.....1.....1.....1....J1....`1.....1.....1.....1.....1.....1.....1.....1.....2....P2....p2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....3....+3..*.>3..+.A3..,._3../.p3..0..3..1..3..2..4..3..4..4.B4..5.~4..6..4..7..5..>.A5..?.K5..N.k5..g.x5..i.{5..j..5..k..5..l..5..h8.5..i8.5..j8.5..k8.5..p8H6..q8.6..y8.6..z8.6..\|8.7...8.7...8(7...8A7...8.7...8.7...8.8...8%8...878...8c8...8.8...8z9...8+:...8E:...8.:...8.:...8.:...8.;...8.<...8.<...8.<...8f=...8$>...8.?...8-?...8G?...8{?...8.A...8.B...8.C...8.D...8GD...8PD...8oD...8.D...8.D...8.D...8mE...8.E...8eF...8.F...8.F...8.F...8hG...8.G...8VH...8.H...8.H...8.H...8.H...8.H...8.I...8KI...8.I...8.I...8.I...8.I...8.I...8.I...8\|J...8.J...8.J...8.J...8$K...80K...8=K...8sK...8.K...8.N...8.O...8>O...8.O...8=P...8vP...8.P...8.P...8.P...8.P...8.P...8.P...8.P...8.Q...8.Q...8.Q...8.Q

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\ar.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	143318
Entropy (8bit):	5.1192878665400245
Encrypted:	false
SSDEEP:
MD5:	B3D9ACE0595615ED68FF956DD31A9FBD
SHA1:	CDEBCE17D8CEC1DCADAC7140175484C6CDAA9A86
SHA-256:	917C2F4DD9C3CD219B928924F4BFD7CD021606784FEF1D81E4F22F0D330DE646
SHA-512:	4E694389B8F167BF9B78C8E7EFEF1250767AD2FD936E1B877591A5D0AFE1DEAD088CEC1E68AE0598E1D0FD81417F38E3F414A6AC088D14CA33C00F5B50751A9D
Malicious:	false
Reputation:	unknown
Preview:	........h...j..0..k..0..l.$0..n.,0..o.10..p.>0..q.D0..r.S0..s.d0..t.m0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0....81....Q1....n1.....1.....1.....1.....1.....1.....2....(2....G2....b2....x2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....2.....3.../3..+.23..,.P3../.g3..0.r3..1..3..2..3..3..3..4..4..5..4..6..4..7..4..>..4..?..4..N..5..g..5..i..5..j."5..k.'5..l.15..h865..i8B5..j8]5..k8r5..p8.5..q816..y8B6..z8J6..\|8p6...8v6...8.6...8.6...8.7...8U7...8o7...8.7...8.7...8.7...8.7...8.8...89...8.9...8.:...82:...8G:...8z:...8,;...8+<...8A<...8d<...8.<...8J=...8.>...8.>...8.?...8T?...8qC...8BE...8.F...8MG...8.G...8.G...8.G...8.G...8.G...8,H...8.H...8.I...8.I...8.I...8.I...8mJ...8.K...8zK...8.L...8QL...8.L...8.L...8.L...8.L...8.L...8.L...8.M...89M...8:M...8SM...8.M...8.M...8.N...8.N...8.N...8.N...8.O...8"O...8,O...8>O...8rO...8wP...8wX...8.X...8.X...8fY...8.Y...8 Z...8gZ...8.Z...8.Z...8.Z...8.Z...8.Z...8.Z...8.Z...8.Z...8.Z...8.Z

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\bg.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	152814
Entropy (8bit):	4.853160877910549
Encrypted:	false
SSDEEP:
MD5:	B3AEBE7284F46164CC33DA9DE0F2E27B
SHA1:	F5437E6A18AAAE167888FE6B049BF7D15909A4A9
SHA-256:	59D1D359999C71216A57EB9A8BE11874FA6C9DADA4C01EC97A0B6043F5D1D75E
SHA-512:	BB7E3583658184A61182F52F96AB3440DF0EF40B5EC4BF57F7131546AB1BC3D81013C617D4666066FFFFCA900ED49E773E18E94D21BF6A59F5F63DEED8772FAF
Malicious:	false
Reputation:	unknown
Preview:	........y...j.,0..k.;0..l.F0..n.N0..o.S0..p.`0..q.f0..r.u0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....1.....1.....1.....1.....1.....1....f1.....1.....1.....1.....1.....1.....1.....1.....2....#2....S2.....2.....2.....2.....2.....2.....2.....3.....3....23....D3....U3....x3.....3.....3.....3....3..+..3..,..3../.H4..0.Q4..1..4..2..4..3..4..4.65..5.k5..6..5..7..6..>.96..?.H6..N.i6..g.w6..i.z6..j.~6..k..6..l..6..i8.6..j8.6..k8.6..p8I7..q8.7..y8.7..z8.8..\|8+8...8=8...8h8...8.8...8.9...8T9...8x9...8.9...8.9...8.9...89:...8.;...8.;...8.<...8.<...8.<...8.=...8M=...88>...8m?...8.?...8.?...8.@...8.@...8.A...8.A...8.A...8.B...8.C...8vD...8=E...8.E...8.E...8.E...8.F...8%F...8MF...8.F...8BG...8.G...8VH...8.H...8.H...8.I...8.I...8WJ...8.J...8CK...8.K...8.K...8.K...8.K...8.K...8(L...8^L...8_L...8.L...8.L...8.L...8M...8.M...8.M...8.N...8)N...8gN...8}N...8.N...8.N...8]O...8.Q...8LR...8xR...8CS...8.S...8.T...8ZT...8.T...8.T...8.T...8.T...8.T...8.T...8.T...8.T...8.T...8.T

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\bn.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	201245
Entropy (8bit):	4.443619562641865
Encrypted:	false
SSDEEP:
MD5:	54DC3B4C2267200DD592148A21DAD5E4
SHA1:	807DF65465A6C4B0C6FFF2919A27ECAED5C24C1A
SHA-256:	024A2879D0699A3BB2A299BA4C28990191BCDF714388A349FA73B737374D5758
SHA-512:	AFC3294BE91AE5421F3B2F233B5CAC803BAA767E19EEC3CE9B129D5CBF6FA52A46E4A85304F58F201E37BBA03D6ED12C35EA1DDE1FA30CAF72026A6D25DEB2C2
Malicious:	false
Reputation:	unknown
Preview:	........k...j..0..k..0..l.0..n.20..o.80..p.E0..q.K0..r.Z0..s.k0..t.t0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....1.....1.....1.....1.....1.....1.....2....K2....M2....Q2.....2.....2.....2.....2.....3....93....]3....`3....a3....w3.....3.....3.....3.....3.....3.....4.... 4....N4...l4..,.o4../..4..0..4..1.45..2.T5..3.p5..4..5..5..6..6..6..7..6..>.57..?.H7..N.}7..g..7..i..7..j..7..k..7..l..7..h8.7..i8.7..j8.8..k8.8..p8.8..q839..y8C9..z8L9..\|8w9...8.9...8.9...8.9...8.:...8.:...8.;...8A;...8W;...8.;...8.<...8U=...8\>...8f?...8.?...8.?...8 @...8i@...8.A...8.C...8.C...8.D...8.D...8.E...8.G...85G...8QG...8.G...8.K...8.L...8.N...8.N...8.O...8$O...8CO...8LO...8{O...8.O...8.P...8NQ...8XR...8uR...8.R...8.R...8.S...8oT...87U...8.U...8.U...8.V...8!V...8*V...83V...8uV...8.V...8.W...8.W...8<W...8?W...8.W...8.W...8.X...8.X...8.X...8.Y...8QY...8iY...8.Y...8.Y...8.[...89`...8n`...8.`...8.a...8Fb...8.b...8.b...8&c...8Zc...8^c...8ic...8.c...8.c...8.c...8.c...8.c

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\ca.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	98674
Entropy (8bit):	5.429585599804141
Encrypted:	false
SSDEEP:
MD5:	4013547D6A142CE975A459C7426509CC
SHA1:	2AE1910131188FE21C28FD0C28D32A2969D5485F
SHA-256:	F96FC2656D0C6FC548181635980318AEB3A4684F12BF54CA5671B96F01CA9FAA
SHA-512:	34B5FA0A0D30FF60AF9F162364048E384970F753889EDBD9B7334EFD394045F3A873B7193D277E4C83D1534F2C20F20DAC747112A74EEA2038A2E6BD34E674E5
Malicious:	false
Reputation:	unknown
Preview:	........v...j.&0..k.50..l.@0..n.H0..o.M0..p.Z0..q.`0..r.o0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....1.....1.....1.....1.....1....=1....W1....p1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2....02....72....:2....;2....D2....M2....U2....Z2....`2....r2....x2.....2.....2..*..2..+..2..,..2../..2..0..2..1..3..2.>3..3.N3..4.m3..5..3..6..3..7..3..>..3..?..3..N..4..g..4..i..4..j..4..k."4..l.(4..h8+4..i834..j8J4..k8^4..p8.4..q8.4..y8.4..z8.4..\|8.5...8.5...8-5...8<5...8.5...8.5...8.5...8.5...8.5...8.5...8.6...8.6...8.7...8.7...8.7...8.7...8.7...8.8...8.8...8k9...8.9...8.9...8.9...8V:...8.:...8.:...8.:...8.:...8.<...8.<...8.=...8`=...8.=...8.=...8.=...8.=...8.=...8.=...86>...8g>...8.>...8.>...8.?...8=?...8.?...8.?...8N@...8.@...8.@...8.@...8.@...8.@...8.@...8.@...8.A...8.A...8.A...8.A...81A...8_A...8.A...8.A...8.A...8.B...8.B...86B...8;B...8IB...8tB...8.B...8lD...8.D...8.D...8.E...8lE...8.E...8.E...8.E...8.F...8.F...8.F...8 F...8#F...8)F...84F

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\cs.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	100715
Entropy (8bit):	5.837901521339819
Encrypted:	false
SSDEEP:
MD5:	0048483FBB6FCC164BB5DFDB0567EDA6
SHA1:	55BC0D015999434860F71DB5E28C6AA04625BDCB
SHA-256:	E29823920D7D2971CCF99BB011A3A54A92C56DD5232D0F12143EBF5F88614430
SHA-512:	585534B48764FB48518168F0535CB27CF7526B599C1463A0A58BF761E016D8D44F934E09C8A1B1DB8CE7485DE7FF98EE17682F78D42A67F8A8801E23D41535C7
Malicious:	false
Reputation:	unknown
Preview:	........o...j..0..k.'0..l.20..n.:0..o.?0..p.L0..q.R0..r.a0..s.r0..t.{0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....1.....1.....1....@1....P1....b1....t1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2....#2....+2....62....B2....G2....M2....j2..*.t2..+.w2..,..2../..2..0..2..1..2..2..3..3..3..4.03..5.Q3..6..3..7..3..>..3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..h8.3..i8.3..j8.4..k804..p8^4..q8.4..y8.4..z8.4..\|8.4...8.4...8.4...8.4...8@5...8_5...8r5...8.5...8.5...8.5...8.5...8'6...8.6...8.6...8.7...8;7...8J7...8l7...8.7...8.8...8.8...8.8...8.9...8.9...8,:...8>:...8Q:...8u:...8v<...8f=...8,>...8n>...8.>...8.>...8.>...8.>...8.>...8.>...80?...8N?...8.?...8.?...8.?...8 @...8u@...8.@...8.A...8-A...8ZA...8bA...8jA...8qA...8tA...8.A...8.A...8.A...8.A...8.A...8.A...8.A...8.B...8TB...8jB...8.B...8.B...8.B...8.B...8.B...8.B...8bC...8uF...8.F...8.F...8"G...8gG...8.G...8.G...8.H...8.H...8.H...8%H...8-H...80H...86H...8@H

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\da.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	91966
Entropy (8bit):	5.447848710170554
Encrypted:	false
SSDEEP:
MD5:	DB4E5FEA714D290A57B1DC3C32FC83CD
SHA1:	03229C65914F87A94A1D2765C457B03F37EB1A97
SHA-256:	1C0A1EB3AA161D39D330060E7BBAB3308FD6F2DE83A25D28955B34658C14E141
SHA-512:	F5E117A6CF3AB9D44E334CD04651FB0ABF7E9900E90D95D27FF2662AD929303A4D5E9A1D748CEFBDFE2A19938C56BD9999BF096BB086D68A3CA7E55F58BD45CE
Malicious:	false
Reputation:	unknown
Preview:	........z...j..0..k.=0..l.H0..n.P0..o.U0..p.b0..q.h0..r.w0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....1.....1.....1.....1.....1.....1....E1....S1....c1....w1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2.....2....)2....02....42....G2..*.Q2..+.T2..,.r2../..2..0..2..1..2..2..2..3..2..4..2..5..3..6.83..7.I3..>.\3..?.e3..N.s3..g.~3..i..3..j..3..k..3..l..3..h8.3..i8.3..j8.3..k8.3..p8.3..q834..y8:4..z8A4..\|8T4...8W4...8k4...8s4...8.4...8.4...8.4...8.4...8.5...8.5...865...8.5...8.5...8c6...8u6...8.6...8.6...8.6...8,7...8.7...8.7...8.7...8.8...8t8...8.8...8.8...8.9...8(9...8Q:...8.:...8g;...8.;...8.;...8.;...8.;...8.;...8.;...8.<...8W<...8}<...8.<...8.=...8 =...8J=...8.=...8.=...8->...8X>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.?...84?...8v?...8.?...8.?...8.?...8.?...8.?...8.?...8.?...8T@...8pB...8.B...8.B...8.B...8AC...8lC...8.C...8.C...8.C...8.C...8.C...8.C...8.C...8.C...8.C...8.C

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\de.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	98107
Entropy (8bit):	5.487724190447551
Encrypted:	false
SSDEEP:
MD5:	311B773A9895CF4A54764D174D597AA0
SHA1:	6444C04EEBFC9D3F8E65BEB8C564ED37D1673F88
SHA-256:	CEA9628D52BFCA596D23D8846972D145C9EAD5629B9D6CC20B2083CEB6E15E45
SHA-512:	1A284870FCF2737452D0DE49333128EB8072D15AD248966A7BB07FF8D38A2212DF40674587D7CA5422CD0BB2ACF4849902EA7F8092C3A45A57C6E93773378193
Malicious:	false
Reputation:	unknown
Preview:	........e...j..0..k..0..l..0..n.&0..o.+0..p.80..q.>0..r.M0..s.^0..t.g0..v.\|0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0....+1....<1....O1....a1....w1....y1....}1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2.....2....)2....92....C2....L2....]2....d2....m2.....2....2..+..2..,..2../..2..0..2..1..2..2..2..3..3..4.)3..5.J3..6..3..7..3..>..3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..h8.4..i8.4..j84..k8>4..p8.4..q8.4..y8.4..z8.4..\|8.5...8.5...8.5...8-5...8\|5...8.5...8.5...8.5...8.5...8.5...8.6...8.6...8.7...8.7...8.7...8.8...8"8...868...8.8...8.9...8.9...8.9...8.9...8v:...8.:...8.:...8.:...8.;...81<...8.<...8?=...8.=...8.=...8.=...8.=...8.=...8.=...8$>...8{>...8.>...8.?...8B?...8S?...8w?...8.?...83@...8.@...8.@...8.@...8.@...8.@...8.A...8.A...84A...8MA...8NA...8aA...8dA...8.A...8.A...8.A...8.B...8;B...8FB...8dB...8nB...8\|B...8.B...8.B...8.D...8.D...8.D...8UE...8.E...8.E...8.F...8'F...87F...8BF...8JF...8MF...8SF...8]F...8`F...8jF

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\el.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	170724
Entropy (8bit):	4.908729260334555
Encrypted:	false
SSDEEP:
MD5:	5CEE60CBC80305D2809BF4E272109484
SHA1:	E8E556FFF48D57D20D62FE0DFC8E51C8F00678F7
SHA-256:	2524B33236CFA90845D02F22C3BE510F8410FBF89C79856EB28DDCD5C885E7EF
SHA-512:	CFAAC077AC4E0E06ECBE4440A4FEBDCA79D77F254896459E1B2C257A76955E3647B01697DAB4103C05907648AE25AB4775A491D9617091A78308EE2CE8F3B946
Malicious:	false
Reputation:	unknown
Preview:	........n...j..0..k.%0..l.00..n.80..o.=0..p.J0..q.P0..r._0..s.p0..t.y0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....1.....1.....1....e1.....1.....1.....1....$2....&2....2....:2....O2....r2.....2.....2.....2.....3.....3.....3.....3....93....S3....e3....u3.....3.....3.....3.....3.....3....4..+..4..,.(4../.x4..0..4..1..5..2.:5..3.R5..4..5..5..5..6.\6..7..6..>..6..?..6..N..6..g..7..i..7..j..7..k..7..l..7..h8"7..i827..j8}7..k8.7..p8.8..q8.8..y8.8..z8.8..\|8.8...8.9...849...8U9...8.9...8;:...8a:...8.:...8.:...8.:...8S;...8F<...8.=...8.>...80>...8.>...8.>...8.>...8.@...8.A...8.A...8.A...8!B...8.C...8.C...8.C...8.D...8KD...8@F...8.G...8"H...8.H...8.H...8.H...8.I...8.I...8<I...8.I...8.J...8mJ...8PK...8.K...8.K...8BL...8.M...8.M...8fN...8.N...8(O...8>O...8RO...8\O...8dO...8.O...8.O...8.O...8.O...8.O...8.O...8*P...8iP...8.Q...8"Q...8\Q...8kQ...8.Q...8.Q...8.Q...8.R...8.R...8.U...8.U...8.U...8.V...8;W...8.W...8.W...8.X...8.X...82X...8=X...8EX...8HX...8NX...8XX

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\en-GB.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	81989
Entropy (8bit):	5.506771279147103
Encrypted:	false
SSDEEP:
MD5:	6EFCFC841A59201EA9F6794E8253F263
SHA1:	E094556A2A387BB84AB56F06FBDA25596A8254CE
SHA-256:	51C9CEFC2ADD35EA6EDEDFFB3DCDBC4AA616A515E99AD166B896E6E9F0C09CE7
SHA-512:	97C559C10CD82483054822F1164E813E7E09349A70A9AFC32FFC3000929AA05032BFD8BCCAAA0369EF10A86EF2CB99466DE87CD17A7A512F596CE9B100B6E37A
Malicious:	false
Reputation:	unknown
Preview:	........y...j.,0..k.;0..l.F0..n.N0..o.S0..p.`0..q.f0..r.u0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....1.....1.....1.....1.....1.....1....B1....O1....^1....n1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2.....2....&2....82..*.@2..+.C2..,.a2../.r2..0.{2..1..2..2..2..3..2..4..2..5..2..6. 3..7.03..>.E3..?.M3..N.\3..g.e3..i.h3..j.l3..k.q3..l.x3..h8}3..i8.3..j8.3..k8.3..p8.3..q8.4..y8.4..z8$4..\|834...874...8A4...8J4...8.4...8.4...8.4...8.4...8.4...8.4...8.4...8V5...8.5...8.6...8.6...866...8B6...8S6...8.6...8.7...8.7...8.7...8.7...8(8...8.8...8.8...8.8...8.8...8.9...8$:...8.:...8.:...8.:...8.:...8.:...8.:...8.;...8#;...8Y;...8.;...8.;...8.;...8.;...8!<...8w<...8.<...8.<...8 =...8G=...8N=...8T=...8Y=...8]=...8o=...8.=...8.=...8.=...8.=...8.=...8.=...8.=...8.>...8/>...8I>...8P>...8j>...8n>...8}>...8.>...8.>...89@...8N@...8X@...8.@...8.@...8.A...83A...8PA...8`A...8dA...8oA...8wA...8zA...8.A...8.A

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\en-US.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	82753
Entropy (8bit):	5.496486042395325
Encrypted:	false
SSDEEP:
MD5:	69D7C5168DE6B4311A36C39CA7CA60F0
SHA1:	40FF72437B51677065D68A6486E3B03E0A27102D
SHA-256:	FDEB2723F423DFE7EE4C19CC052398CBE796BFCE7D432D0ABE4EA40E6C6E3DAB
SHA-512:	4E1FD01BD7D5F65F8AA2F0B2F4845106DF916A53DD4898D0CEC7FC538C2908D22F4FFD3DACF023C7854F4854534468A9BC93763BE21075661501C6CECA2CA0E7
Malicious:	false
Reputation:	unknown
Preview:	............j.<0..k.K0..l.V0..n.^0..o.c0..p.p0..q.v0..r..0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....1.....1.....1.....1....!1....(1....)1....1....R1...._1....n1....~1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2.... 2....+2..../2....62....H2...P2..+.S2..,.q2../..2..0..2..1..2..2..2..3..2..4..2..5..2..6./3..7.?3..>.T3..?.\3..N.k3..g.t3..i.w3..j.{3..k..3..l..3..h8.3..i8.3..j8.3..k8.3..p8.3..q8$4..y8-4..z824..\|8A4...8E4...8O4...8X4...8.4...8.4...8.4...8.4...8.4...8.4...8.5...8[5...8.5...8.6...8.6...8<6...8H6...8]6...8.6...8.7...8.7...8.7...8.7...8,8...8.8...8.8...8.8...8.8...8.9...8T:...8.:...8.:...8.;...8#;...8-;...84;...8?;...8[;...8.;...8.;...8.<...8%<...85<...8]<...8.<...8.<...89=...8]=...8.=...8.=...8.=...8.=...8.=...8.=...8.=...8.=...8.=...8.=...8.=...8.>...8.>...8[>...8l>...8.>...8.>...8.>...8.>...8.>...8.>...84?...8.@...8.@...8.@...8.A...8EA...8jA...8.A...8.A...8.A...8.A...8.A...8.A...8.A...8.A...8.A

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\es-419.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	96465
Entropy (8bit):	5.396846953703645
Encrypted:	false
SSDEEP:
MD5:	0528657080F23F99B4868C7B7A44701B
SHA1:	75F87D39EFC7CE8EFCCF826EE50CED53ADDD7B1A
SHA-256:	2110D69AD5952F037130E8DF869C170C299FC2FBE9A6D002E919219AF673E504
SHA-512:	030104F1A46334EA8F67B843C59BDA775DEB372E89B64EFF63F73E719D34FD1305975F60912BC3F0B4FDF38D8868829D427EB9DAF44D29FC01DA60BA7B29569F
Malicious:	false
Reputation:	unknown
Preview:	........y...j.,0..k.;0..l.F0..n.N0..o.S0..p.`0..q.f0..r.u0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....1.....1.....1.....1.....1.....1....@1....R1....a1....v1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2....$2....-2....62....<2....C2....T2....Z2....b2.....2..*..2..+..2..,..2../..2..0..2..1..3..2.)3..3.83..4.V3..5.y3..6..3..7..3..>..3..?..3..N..4..g..4..i..4..j..4..k.!4..l.)4..h8.4..i874..j8K4..k8Y4..p8.4..q8.4..y8.4..z8.4..\|8.4...8.5...8"5...845...8.5...8.5...8.5...8.5...8.5...8.5...8(6...8.6...8.7...8.7...8.7...8.7...8.7...8.8...8.8...8p9...8.9...8.9...8.9...8O:...8.:...8.:...8.:...8.:...8.;...8T<...8.<...88=...8\=...8d=...8p=...8{=...8.=...8.=...8.=...8)>...8.>...8.>...8.>...8.>...8]?...8.?...8.@...85@...8i@...8r@...8{@...8~@...8.@...8.@...8.@...8.@...8.@...8.@...8.@...8.A...8#A...8qA...8.A...8.A...8.A...8.A...8.A...8.A...8.A...8XB...8.C...8.C...8.D...8.D...8.D...8.E...8RE...8.E...8.E...8.E...8.E...8.E...8.E...8.E...8.E

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\es.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	98766
Entropy (8bit):	5.370238318958416
Encrypted:	false
SSDEEP:
MD5:	2D23B7392C15DA1143E404E9CB0F174F
SHA1:	199AC9A5838A9D0861CA2ABBB1387EF8914EACB4
SHA-256:	2BABD67A3A43C5674FCF1D0AD7165F54C2F1E7D39A0BA99CCE49631F08BA408C
SHA-512:	0A3087F53932F52F2D76EB619875207467A02726AAAF94EE0AAD4AF4B73DA8F859F4FF63DBD8E203358E53F49D5EEFD5BC9D50294BD30047B0058C4A3A55659A
Malicious:	false
Reputation:	unknown
Preview:	........x...j.0..k.90..l.D0..n.L0..o.Q0..p.^0..q.d0..r.s0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....1.....1.....1.....1.....1.....1....G1....Z1....j1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2....!2....$2....%2.....2....72....@2....F2....M2....^2....d2....l2.....2....2..+..2..,..2../..2..0..2..1..3..2.$3..3.33..4.Q3..5.p3..6..3..7..3..>..3..?..3..N..4..g..4..i..4..j..4..k..4..l.%4..h8+4..i844..j8M4..k8[4..p8.4..q8.4..y8.4..z8.4..\|8.5...8.5...8:5...8I5...8.5...8.5...8.5...8.5...8.5...8.6...8>6...8.6...8)7...8.7...8.7...8.7...8.8...8 8...8.8...8V9...8m9...8.9...8.9...8.:...8.:...8.:...8.:...8.:...8.;...8L<...8.<...8.=...8;=...8C=...8O=...8Y=...8i=...8.=...8.=...8.>...8.>...8.>...8.>...8.?...8.?...8.?...85@...8i@...8.@...8.@...8.@...8.@...8.@...8.@...8.@...8.@...8.@...8.A...8.A...87A...8ZA...8.A...8.A...8.A...8.A...8.A...8.B...8.B...87B...8.B...8.D...8'D...8:D...8.D...8.E...8/E...8XE...8xE...8.E...8.E...8.E...8.E...8.E...8.E...8.E

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\et.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	88235
Entropy (8bit):	5.500611162999328
Encrypted:	false
SSDEEP:
MD5:	7181963D67E84ACBA65823D95C71C4D9
SHA1:	694452230D2A22E918F59D7CD5E029A127520327
SHA-256:	544363C3057E7B4BC132AD8FE320EBC12170D0B706F00706AB1DE5CD9DB21942
SHA-512:	D2B79DBA2D688743EEFF805530B95808B80C62B9C262E786423DB69B8C2112B56E9BA82EF3CACC39D3303593449A3C4A446D6B615BF549F2CFB7D31ED866A456
Malicious:	false
Reputation:	unknown
Preview:	............j.80..k.G0..l.R0..n.Z0..o._0..p.l0..q.r0..r..0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....1.....1.....1.....1....$1....%1....&1....X1....h1....z1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2.....2....(2....22....82....=2....E2....P2....V2....\2....u2..*..2..+..2..,..2../..2..0..2..1..2..2..2..3..3..4..3..5.?3..6.w3..7..3..>..3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..h8.3..i8.3..j8.4..k8.4..p8M4..q8.4..y8.4..z8.4..\|8.4...8.4...8.4...8.4...8.5...8T5...8h5...8t5...8z5...8.5...8.5...8.6...8}6...8.6...8.6...8!7...8/7...8H7...8.7...8j8...8y8...8.8...8.8...869...8.9...8.9...8.9...8.9...8.:...8T;...8.;...8.;...8.<...8.<...8 <...8'<...89<...8]<...8.<...8.<...8#=...8C=...8U=...8.=...8.=...8%>...8l>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.?...8.?...8<?...8e?...8.?...8.?...8.?...8.?...8.@...8.@...81@...8R@...8.@...8.A...8.B...8(B...8.B...8.B...8.B...8.C...8-C...8=C...8AC...8LC...8TC...8WC...8]C...8gC...8jC

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\fa.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	136948
Entropy (8bit):	5.207380833001933
Encrypted:	false
SSDEEP:
MD5:	D74CE015109AB5938DBC38F50CD010FA
SHA1:	E3DB2BE146B2CF6E6FA4A1784573B20127FEFBFC
SHA-256:	E098DA4339B9E5F59119AE7EDDF567C775B85AC32A4D5AFCA4F88AF8F4C496CA
SHA-512:	73BED8BE98BE6C18FEA762DA27F68081B3BBC6DAC9C2DB82F16D8D0729C867A8F658F6B57E489C90E8C3B01BAB6459D562D7D7D6022FCD44BB90F9F4ED206DFD
Malicious:	false
Reputation:	unknown
Preview:	........Z...j../..k../..l..0..n..0..o..0..p."0..q.(0..r.70..s.H0..t.Q0..v.f0..w.s0..y.y0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0....$1....>1....Z1.....1.....1.....1.....1.....1.....1.....1.....2....)2....J2....b2....i2....l2....}2.....2.....2.....2.....2.....2.....2.....2.....3....3..+."3..,.@3../.d3..0.r3..1..3..2..3..3..3..4..4..5.=4..6..4..7..4..>..5..?..5..N.55..g.?5..i.B5..j.F5..k.K5..l.U5..h8_5..i8i5..j8.5..k8.5..p8.6..q8.6..y8.6..z8.6..\|8.6...8.6...8.7...8.7...8.7...8.7...8.7...8.7...8.8...818...8.8...8\|9...8Q:...8-;...8E;...8.;...8.;...8.;...8.<...8.=...8.>...88>...8.>...8K?...8 @...8>@...8\@...8.@...8.B...8.C...8.D...8BE...8.E...8.E...8.E...8.E...8.F...8.F...8.F...8sG...8.G...8.G...8.H...8.H...8.I...8.I...8.I...8.J...8!J...8'J...8-J...8WJ...8uJ...8.J...8.J...8.J...8.J...8.J...8-K...8.K...8.K...8.L...8!L...8IL...8UL...8gL...8.L...8,M...8.P...8-Q...8CQ...8.Q...8RR...8.R...8.R...8.R...8.R...8.R...8.S...8.S...8.S...8 S...8S...8-S...8=S...8@S...8NS

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\fi.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	90993
Entropy (8bit):	5.45089195578874
Encrypted:	false
SSDEEP:
MD5:	9D2E06C40BF09B84C580AC9F47729E33
SHA1:	C4BD3A450758B01D4BA4A4AE49606BD94D8353AF
SHA-256:	00CD5BBE18B8FE92218ABBF2F5847F940642AB3F02B92CBC9EC89E38217153E2
SHA-512:	C561004F7C98B88C23664E47D683100E6F7094F8F6EB4DA6DE31E2978983AF9AA9D2D917B4F021DBF2ADE64108E8CDC3259CC22B7B1D49B838C5ADA799FE4150
Malicious:	false
Reputation:	unknown
Preview:	........m...j..0..k.#0..l..0..n.60..o.;0..p.H0..q.N0..r.]0..s.n0..t.w0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....1.....1.....1....,1....>1....O1....b1....{1....}1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2....!2....)2....12....B2..*.J2..+.M2..,.k2../..2..0..2..1..2..2..2..3..2..4..3..5.&3..6.`3..7..3..>..3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..h8.3..i8.3..j8.4..k8.4..p8I4..q8.4..y8.4..z8.4..\|8.4...8.4...8.4...8.4...8-5...8R5...8d5...8u5...8{5...8.5...8.5...8-6...8.6...8.6...8.7...8,7...897...8]7...8.7...8.8...8.8...8.8...8.8...8_9...8.9...8.9...8.9...8.:...8.:...8f;...8.;...8.<...8,<...83<...8A<...8M<...8Z<...8{<...8.<...8.<...8:=...8L=...8[=...8.=...8.=...8.>...8`>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.?...8.?...8.?...8.?...8F?...8k?...8.?...8.?...8.?...8.?...8.@...8.@...8.@...8=@...8.@...8.A...8.A...8.B...8.B...8.B...8.B...8.C...8@C...8PC...8TC...8_C...8gC...8jC...8pC...8zC...8}C

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\fil.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	100246
Entropy (8bit):	5.225847902351937
Encrypted:	false
SSDEEP:
MD5:	6FB2A5C3D866A4F04A0C4CB77B0DACAA
SHA1:	D9CA70EEF11DE7F3DBE83888CC56B44BFDAFD138
SHA-256:	5C235AD9F256ADA278F7AFB139EED9C5EB9EB8154A8F60581D9D67B90225E0A3
SHA-512:	02CA2D6D59C003B4C705495DF6C26C17F9B901CCDA10D2B8351F986CD0BEC955F2699075B9971C11CE22783B8B571732A22C9E36F6AD7B43BCF677C10A30F1A8
Malicious:	false
Reputation:	unknown
Preview:	........v...j.&0..k.50..l.@0..n.H0..o.M0..p.Z0..q.`0..r.o0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....1.....1.....1.....1.....1....;1....H1....]1....s1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2....!2....)2....42....92....B2....S2....Z2....b2.....2..*..2..+..2..,..2../..2..0..2..1..3..2..3..3.&3..4.D3..5.e3..6..3..7..3..>..3..?..3..N..3..g..3..i..3..j..3..k..4..l..4..h8.4..i8.4..j884..k8L4..p8.4..q8.4..y8.4..z8.4..\|8.4...8.4...8.5...8.5...8e5...8.5...8.5...8.5...8.5...8.5...8.5...8^6...8.6...8?7...8U7...8.7...8.7...8.7...8L8...8.9...8 9...899...8j9...8.9...8y:...8.:...8.:...8.:...8-<...8.<...8.=...8.=...8.>...8.>...8.>...8&>...85>...8[>...8.>...8.>...83?...8R?...8i?...8.?...8.@...8Q@...8.@...8.@...8.A...8.A...8.A...8.A...8#A...8;A...8WA...8lA...8mA...8~A...8.A...8.A...8.A...8.B...86B...8RB...8^B...8.B...8.B...8.B...8.B...85C...8aE...8.E...8.E...8.F...8UF...8.F...8.F...8.F...8.F...8.G...8.G...8.G...8.G...8.G...8)G

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\fr.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	106408
Entropy (8bit):	5.394027058129029
Encrypted:	false
SSDEEP:
MD5:	5AD4C6BF4AABB6AD1A3EA7F4195EDECB
SHA1:	8CBAAC148ADC93A32813A1873EE55EA69FC98FF7
SHA-256:	D7B484EB37004F7CC67492DE617FE79EC040EB85A5B192515C13D8FE286FBCB0
SHA-512:	8056A4D716041ED2886DCA18AB410B23BFAE12E8AC181CA33E13FE7D8B6D0A5A479FAAB9E0D67A5E3D3B9FCC1A7CF4C4193CA1F6C7939C6FE4ACA81E069813A4
Malicious:	false
Reputation:	unknown
Preview:	........o...j..0..k.'0..l.20..n.:0..o.?0..p.L0..q.R0..r.a0..s.r0..t.{0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....1.....1.....1....+1....;1....I1....[1....j1....l1....p1....w1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2....!2....42....:2....A2....b2...l2..+.o2..,..2../..2..0..2..1..2..2..3..3..3..4.3..5.J3..6..3..7..3..>..3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..h8.3..i8.4..j8)4..k8@4..p8.4..q8.4..y8.4..z8.4..\|8.5...8.5...8#5...875...8.5...8.5...8.5...8.5...8.5...8.6...866...8.6...8K7...8.7...8.7...8$8...848...8O8...8.8...8.9...8.9...8.9...8.:...8.:...8X;...8k;...8.;...8.;...8l=...8=>...8.>...8B?...8n?...8.?...8.?...8.?...8.?...8.@...8K@...8.@...8.@...8.@...8'A...8.A...8.B...8sB...8.B...8.B...8.B...8.B...8.B...8.B...8.C...8.C...8%C...8&C...8=C...8HC...8vC...8.C...8.C...8.C...8.D...8.D...8BD...8JD...8XD...8.D...8.E...8.G...8.G...8.G...8bH...8.H...8.H...8$I...8FI...8VI...8gI...8rI...8zI...8}I...8.I...8.I...8.I

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\gu.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	192119
Entropy (8bit):	4.489665808153001
Encrypted:	false
SSDEEP:
MD5:	A54336A9B493ACA63C8A68C0101EA98F
SHA1:	CFBB0B636AAB219BF25EB4B64A9449B25BE63F24
SHA-256:	CF59481E3115DF302EB4BE2CA5DC7305D2752683B16021EEB32E390D0E762AF2
SHA-512:	58AD77B36A52892813BAAB769026491ED249643BD923CC33C4FD4AED85E3FCA5D75F9C09A5E3555D26A8768809A5981C764E1E1D482003E26ADE90AA19C65385
Malicious:	false
Reputation:	unknown
Preview:	........o...j..0..k.'0..l.20..n.:0..o.?0..p.L0..q.R0..r.a0..s.r0..t.{0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....1.....1.....1.....1.....1.....1.....2....82....:2....F2....\|2.....2.....2.....2.....2.....3....:3....A3....D3....F3...._3....x3.....3.....3.....3.....3.....3.....4....>4..*.f4..+.i4..,..4../..4..0..4..1.D5..2.[5..3.~5..4..5..5..5..6.J6..7..6..>..6..?..6..N.'7..g.77..i.:7..j.>7..k.C7..l.Q7..h8V7..i8i7..j8.7..k8.7..p8.8..q8&9..y8@9..z8I9..\|8z9...8.9...8.9...8.9...8u:...8.:...8.:...8.;...8";...8^;...8.;...8.<...8.=...8.>...8.?...8v?...8.?...8.?...8#A...8.B...8.B...8=C...8.C...8.D...8.F...8DF...8dF...8.F...8wJ...8.L...80M...8.M...8.N...8(N...8AN...8SN...8\|N...8.N...8.O...8.O...8.P...8.Q...8MQ...8.Q...8.R...8aS...8.T...8`T...8.T...8.T...8.T...8.U...8.U...8]U...8.U...8.V...8.V...8?V...8BV...8.V...8.V...8qW...8.W...8.W...8.X...8sX...8.X...8.X...8.Y...8.Y...88_...8l_...8._...8.`...83a...8.a...8.a...8.b...8,b...80b...8Rb...8Zb...8]b...8cb...8mb

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\he.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	119935
Entropy (8bit):	4.880707163375687
Encrypted:	false
SSDEEP:
MD5:	282D40F2BB10CD0C449A9E8E886ECB19
SHA1:	3763402E515C68907C07180EFCD584CE71711067
SHA-256:	2941C4CB656BF8B8F5B27A44E1A60FF15751516CD6EB7015399C6002CA1D9C50
SHA-512:	6086979D67BB4EA0400F1A0E1469F5F4A7DE3F3B880BFB9D755CE1EB8CDDC16A888FFF9E74A0E5B135907E88F115B45BF876EE78D00054DC9B14AEB9E8254EFE
Malicious:	false
Reputation:	unknown
Preview:	........f...j..0..k..0..l. 0..n.(0..o.-0..p.:0..q.@0..r.O0..s.`0..t.i0..v.~0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0....D1....[1....t1.....1.....1.....1.....1.....1.....1.....1.....2.....2....52....K2....R2....U2....V2....^2....f2....n2....v2.....2.....2.....2.....2.....2..*..2..+..2..,..2../..2..0..3..1.D3..2.Y3..3.y3..4..3..5..3..6..4..7.44..>.I4..?.Z4..N.s4..g..4..i..4..j..4..k..4..l..4..h8.4..i8.4..j8.4..k8.4..p8+5..q8.5..y8.5..z8.5..\|8.5...8.5...8.5...8.5...8\6...8.6...8.6...8.6...8.6...8.6...8,7...8.7...8W8...8.8...8.9...8<9...8M9...8r9...8#:...8.;...8/;...8O;...8.;...8;<...8)=...89=...8U=...8.=...8.@...8?A...8kB...8.B...8.B...8.C...8.C...8$C...89C...8`C...8.C...8.C...8bD...8.D...8.D...8.D...8jE...8.E...8.F...8NF...8.F...8.F...8.F...8.F...8.F...8.F...8.F...8.G...8.G...8!G...8$G...8^G...8.G...8.H...80H...8_H...8nH...8.H...8.H...8.H...8.H...8.I...8LM...8qM...8.M...8.N...8kN...8.N...8.N...8.O...8%O...8)O...84O...8<O...8?O...8EO...8OO

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\hi.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	198052
Entropy (8bit):	4.455180946377406
Encrypted:	false
SSDEEP:
MD5:	A5DD558CE96041169F47421C95E43D96
SHA1:	0B20D322AAD4836AEBE271ECAFEBA012FC011F5B
SHA-256:	6F08EBD28C703A4FC1142D296901B0CF2D6A34143C91363D0555C9E548C88770
SHA-512:	DC96D157CFAB89F1E2D56FA8D6754693F100349EC5F2D1A15C0B9E7F00FA98714E3D73D09C572761821C41263E1E5A5F0465475EAA19FD3290ED3D56374D6595
Malicious:	false
Reputation:	unknown
Preview:	........]...j../..k..0..l..0..n..0..o..0..p.(0..q..0..r.=0..s.N0..t.W0..v.l0..w.y0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0....t1.....1.....1.....1.....2.....2.....2....C2....V2....{2.....2.....2.....2.....3....!3....$3....&3....?3....X3....q3.....3.....3.....3.....3.....4....+4...J4..+.M4..,.k4../..4..0..4..1.>5..2.a5..3..5..4..5..5..5..6.M6..7..6..>..6..?..6..N./7..g.R7..i.U7..j.Y7..k.^7..l.l7..h8q7..i8.7..j8.7..k8.8..p8.8..q8\9..y8.9..z8.9..\|8.9...8.9...8.9...8.:...8.:...8.;...8@;...8u;...8.;...8.;...8I<...8@=...8>...8!?...8M?...8.?...8.?...8.?...80A...8.B...8.B...86C...8.C...8.E...8.F...8RF...8.F...8.F...8.I...84K...8oL...8.L...84M...8JM...8iM...8{M...8.M...8<N...8mO...8.O...8.P...8.P...8.Q...8`Q...86R...8.S...8.S...8rT...8.T...8.T...8.T...8.T...8IU...8.U...8.U...8.U...8.V...8.V...8.V...8@W...8.W...8.X...8OX...8.X...8.X...8.X...8<Y...8"Z...8.`...8Va...8\|a...8.b...83c...8.c...8.c...8%d...85d...89d...8Dd...8]d...8`d...8fd...8pd...8sd...8}d

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\hr.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	96027
Entropy (8bit):	5.53821706221157
Encrypted:	false
SSDEEP:
MD5:	F35A2275448CB3694572F7D769BBEEA6
SHA1:	557BD9ECD5646729BC32854C495546EF43186D16
SHA-256:	4D4294BA0AFC76944CFADD39850F430443FE03967BA18978EB8F2EA45CAA35AC
SHA-512:	66C8C30716CA96AE81CC7C9BD39F12EBD6427C00E097C94CE357ED5E3EAE6BC48BF3C97BE74A628D4BFC6EF9BBF279581DE8B1776C035486FE16F1E0623937B7
Malicious:	false
Reputation:	unknown
Preview:	........y...j.,0..k.;0..l.F0..n.N0..o.S0..p.`0..q.f0..r.u0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....1.....1.....1.....1.....1.....1....C1....O1....[1....i1....z1....\|1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.... 2....(2....42....:2....B2....d2..*.o2..+.r2..,..2../..2..0..2..1..2..2..2..3..3..4.!3..5.?3..6..3..7..3..>..3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..h8.3..i8.3..j8.4..k8(4..p8W4..q8.4..y8.4..z8.4..\|8.4...8.4...8.4...8.4...8A5...8n5...8.5...8.5...8.5...8.5...8.5...8M6...8.6...8.7...8(7...8I7...8V7...8j7...8.7...8.8...8.8...8.8...8.9...8.9...8B:...8V:...8b:...8.:...8~<...8o=...8A>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...88?...8b?...8.?...8.?...8.?...8.@...8~@...8.@...8"A...8LA...8qA...8xA...8~A...8.A...8.A...8.A...8.A...8.A...8.A...8.A...8.B...87B...8\|B...8.B...8.B...8.B...8.B...8.B...8.B...8.C...8.C...8^F...8sF...8.F...8.F...88G...8cG...8.G...8.G...8.G...8.G...8.G...8.G...8.G...8.G...8.G...8.G

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\hu.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	102624
Entropy (8bit):	5.657724837619036
Encrypted:	false
SSDEEP:
MD5:	51846B21B193E3C46E22E52D4B378F41
SHA1:	39A49DC473D8103EA381A81840D65DA66FC5CB37
SHA-256:	65C2A61B382707028EC5E1A1D307D02E623F0C6AF313EB7834B39734BFABAABB
SHA-512:	C4DC6F8E542EB2AB196E11065CC2EE8963DBC04253FF7B3620C67A6D6721738A6008F12EF1BB7CA24FCEBEA4A4974A41407D409525B56A7BBC26F07BFCFADE60
Malicious:	false
Reputation:	unknown
Preview:	........m...j..0..k.#0..l..0..n.60..o.;0..p.H0..q.N0..r.]0..s.n0..t.w0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....1.....1.....1....A1....Q1....g1....\|1.....1.....1.....1.....1.....1.....1.....1.....1.....2....22....92....<2....=2....J2....W2....g2....p2....z2.....2.....2.....2.....2..*..2..+..2..,..2../..2..0..3..1.;3..2.G3..3.T3..4.q3..5..3..6..3..7..3..>..4..?..4..N.'4..g.54..i.84..j.<4..k.A4..l.H4..h8M4..i8T4..j8j4..k8.4..p8.4..q8.5..y8,5..z835..\|8E5...8L5...8^5...8n5...8.5...8.5...8.5...8.5...8.5...8.6...8:6...8.6...8.7...8.7...8.7...8.7...8.7...8.8...8.8...8m9...8.9...8.9...8.9...8^:...8.:...8.:...8.:...8.:...8.<...8.<...8.=...8R=...8.=...8.=...8.=...8.=...8.=...8.=...8=>...8f>...8.>...8.>...8.?...8O?...8.?...8.@...8.@...8.@...8.@...8.@...8.@...8.A...8.A...8 A...8;A...8LA...8MA...8aA...8dA...8.A...8.A...8$B...8=B...8VB...8]B...8.B...8.B...8.B...8.B...83C...8.D...8.D...8.D...8jE...8.E...8.E...8.F...8AF...8QF...8\F...8dF...8gF...8mF...8wF...8zF

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\id.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	88546
Entropy (8bit):	5.3782769811723465
Encrypted:	false
SSDEEP:
MD5:	31751C408273F18D352CFC8E842D5F93
SHA1:	2666CB7A297470A770E4588EECC44EDEF7077BC8
SHA-256:	72D2B03E45DA3D0091AC0CCEAAB8EC231C1750EBE1D33D1D5E7FA0EE36A023CE
SHA-512:	D85472E400889864C4412D8FE7F1E9AA6A465F79ED8912545ACB3A62ED411AB16C4BD2A176390A47DF7D4ACA07E7AD373680054FA405C3CEC68D342201270439
Malicious:	false
Reputation:	unknown
Preview:	........g...j..0..k..0..l."0..n.0..o./0..p.<0..q.B0..r.Q0..s.b0..t.k0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....1....'1....41....D1....V1....X1....\1....d1....l1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2....-2...82..+.;2..,.Y2../.i2..0.m2..1..2..2..2..3..2..4..2..5..2..6.$3..7.73..>.K3..?.S3..N.d3..g.m3..i.p3..j.t3..k.y3..l..3..h8.3..i8.3..j8.3..k8.3..p8.3..q864..y8?4..z8E4..\|8U4...8[4...8h4...8t4...8.4...8.4...8.4...8.4...8.4...8.5...895...8.5...8.6...8.6...8.6...8.6...8.6...8.6...8n7...8&8...858...8G8...8m8...8.8...8D9...8T9...8b9...8.9...8^:...8.:...8N;...8.;...8.;...8.;...8.;...8.;...8.;...8.;...81<...8\<...8.<...8.<...8.<...8.<...8X=...8.=...8.=...8.>...8<>...8F>...8P>...8U>...8Z>...8p>...8.>...8.>...8.>...8.>...8.>...8.>...8.?...8T?...8i?...8}?...8.?...8.?...8.?...8.?...8.?...8+@...8.A...8.A...8.A...8.B...8]B...8.B...8.B...8.B...8.B...8.B...8.B...8.B...8.B...8.B...8.B

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\it.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	96162
Entropy (8bit):	5.3036606540514635
Encrypted:	false
SSDEEP:
MD5:	489836D02C0EEE96C1DC09D1ACDC5CDA
SHA1:	84B48AEF823999D0650E6D49E5F5F03FC7AD4D5E
SHA-256:	95E8465B44841ED6C58A5C3F708B726343E7401B5F07769A8023C0DA56BC96E1
SHA-512:	2C70B41796EE94C5DEB0329FAC2C6DF36FCB75B687FE75C26FAF423EFD2FA8D81E56B5C3225B19A6235FBB256263021C59E461393ED99850033F064928832A86
Malicious:	false
Reputation:	unknown
Preview:	........u...j.$0..k.30..l.>0..n.F0..o.K0..p.X0..q.^0..r.m0..s.~0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....1.....1.....1.....1.....1....=1....P1...._1....x1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2....'2....22....<2....B2....H2....X2....`2....f2.....2..*..2..+..2..,..2../..2..0..2..1..3..2.$3..3.,3..4.L3..5.j3..6..3..7..3..>..3..?..3..N..3..g..4..i..4..j..4..k..4..l..4..h8.4..i8%4..j8B4..k8S4..p8.4..q8.4..y8.4..z8.4..\|8.5...8.5...8.5...8"5...8k5...8.5...8.5...8.5...8.5...8.5...8.5...8Y6...8.6...8H7...8e7...8.7...8.7...8.7...8V8...8+9...8:9...8T9...8.9...8.:...8g:...8r:...8.:...8.:...8.;...8]<...8.<...8+=...8Q=...8d=...8n=...8{=...8.=...8.=...8.>...8.>...8.>...8.>...8.>...8_?...8.?...8.@...8?@...8q@...8y@...8.@...8.@...8.@...8.@...8.@...8.@...8.@...8.@...8.@...8.A...8!A...8iA...8zA...8.A...8.A...8.A...8.A...8.A...8.A...8LB...8#D...89D...8HD...8.D...8.E...8;E...8eE...8.E...8.E...8.E...8.E...8.E...8.E...8.E...8.E...8.E

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\ja.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	116114
Entropy (8bit):	5.838162760573745
Encrypted:	false
SSDEEP:
MD5:	FDEC518417A7F06C4154FC9E37593456
SHA1:	0AEAECE9D345DEB14F8C6580B83A85988EBBBEF1
SHA-256:	1D3C578CBFFE948D0A067037B36E278E9079CF867C34A6782F021F36F69B6EE3
SHA-512:	F682BC5006D964C9F7DE789E15B25027B02D57C95AA49F34ED8E16593C7747F6A6E0F4B8F30E255F5F47F224D222EF86CDB0AC078634D8C1024F77446B80BF7A
Malicious:	false
Reputation:	unknown
Preview:	........I...j../..k../..l../..m../..o..0..p..0..q..0..v.%0..w.20..y.80..z.G0..\|.M0..}._0....g0....l0....t0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....1....-1....N1....o1....q1....u1.....1.....1.....1.....1.....1.....1.....2...."2....%2.....2....72....=2....F2....S2....f2....l2....r2.....2....2..+..2..,..2../..2..0..2..1.'3..2.>3..3.M3..4.n3..5..3..6..3..7..4..>. 4..?.4..N.?4..g.L4..i.O4..j.S4..k.X4..l.`4..h8e4..i8k4..j8.4..k8.4..p8.4..q8d5..y8m5..z8s5..\|8.5...8.5...8.5...8.5...8.6...8L6...8m6...8.6...8.6...8.6...8.6...8d7...8.7...8d8...8v8...8.8...8.8...8.8...8f9...87:...8H:...8l:...8.:...8c;...8.;...8.;...8.<...8A<...8,=...8.=...8R>...8.>...8.>...8.>...8.>...8.>...8.?...8@?...8.?...8.?...8L@...8`@...8r@...8.@...8.@...8AA...8.A...8.A...8-B...83B...86B...89B...8]B...8{B...8.B...8.B...8.B...8.B...8.B...8'C...8~C...8.C...8.C...8.C...8.C...8.C...8.D...8!D...8.D...8XF...8wF...8.F...8.G...8.G...8.G...8.H...8^H...8nH...8rH...8}H...8.H...8.H...8.H...8.H...8.H...8.H...8.H

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\kn.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	221022
Entropy (8bit):	4.393581366702196
Encrypted:	false
SSDEEP:
MD5:	4ECC3C72AA44C780B23865607FA1CB41
SHA1:	52318009C1CB842145619FD6D4F074339E65962F
SHA-256:	DDC03DEC274CE2DE380E95DC5C3F5A71902D410C9786D5492E3FC96B508607CB
SHA-512:	09B29ABE06B4166F441AD6563ADC172AEE9D489ACECFE1DB92A8551B88DE791BE38E0976F3FAB6EF6CDC9AE33BCC9374C7417ABA2728B26E9E1E48F290C258B7
Malicious:	false
Reputation:	unknown
Preview:	........t...j."0..k.10..l.<0..n.D0..o.I0..p.V0..q.\0..r.k0..s.\|0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....1.....1.....1.....1.....1.....1.....1.....2....P2.....2.....2.....2.....2.....2.....3....F3....}3.....3.....3.....3.....3.....4.....4....<4....Z4....r4.....4.....4.....4.....4.....5...85..+.;5..,.Y5../..5..0..5..1.;6..2.U6..3.m6..4..6..5..7..6..7..7..7..>..8..?.!8..N.j8..g..8..i..8..j..8..k..8..l..8..h8.8..i8.8..j8.9..k839..p8.:..q8.:..y8.:..z8.:..\|8.;...8.;...8P;...8u;...8.<...8~<...8.<...8.<...8.=...8J=...8.=...8.?...8.@...8A...8dA...8.A...8.A...8HB...8.C...8.E...8.F...8ZF...8.F...87H...8.I...8.I...8.J...8jJ...8oN...8.P...8bQ...8 R...8.R...8.R...8.R...8.S...8.S...8jT...8.T...8.V...83V...8.V...8.V...8.W...8.X...8.Y...8.Z...8.Z...8.Z...8.Z...8.Z...8.Z...86[...8.[...8.[...8.[...8.\...8.\...8N\...8.\...8g]...8.]...8.]...8.]...8D^...8S^...8j^...8.^...8._...8If...8.f...8.f...8.h...8.h...8.i...8.i...8.i...8.i...8.i...8.j...8.j...8.j...8.j...8.j...8.j

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\ko.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	98020
Entropy (8bit):	6.161281254258991
Encrypted:	false
SSDEEP:
MD5:	278CE6DEE522E4A06F3E3D81EFEC86D2
SHA1:	B2CEB8C5457F8492F527C26B2A8192210EDF58DE
SHA-256:	0BCFE82B5227B4192D10412866E50FBD39EB74FF4E55FAF44A31D4E96C395AE5
SHA-512:	32ECCE1C5B3B3046E13296313E8323ED4B6C17C731CA3613AAC44C848D72C41B02716EA1087DB8B453E7CE28675D97760FF110F23BDAB5B19D3D4B0482B6EDA0
Malicious:	false
Reputation:	unknown
Preview:	........F...j../..k../..l../..m../..o../..p../..q../..r..0..s..0..t..0..y.40..z.C0..\|.I0..}.[0....c0....h0....p0....{0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....1...."1....$1....(1....41....;1....Q1....a1....n1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2..*..2..+..2..,.B2../.X2..0.d2..1..2..2..2..3..2..4..2..5..3..6.C3..7.Y3..>.p3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..h8.3..i8.3..j8.3..k8.3..p874..q8.4..y8.4..z8.4..\|8.4...8.4...8.4...8.4...8.5...8b5...8r5...8.5...8.5...8.5...8.5...8T6...8.6...8L7...8c7...8.7...8.7...8.7...8Y8...8T9...8e9...8y9...8.9...80:...8.:...8.:...8.:...8.:...8.;...8z<...8.<...8A=...8u=...8.=...8.=...8.=...8.=...8.>...8O>...8.>...8.>...8.>...8.?...8u?...8.?...8.@...88@...8]@...8c@...8f@...8l@...8.@...8.@...8.@...8.@...8.@...8.@...8.A...8+A...8zA...8.A...8.A...8.A...8.A...8.A...8.A...8.B...8TB...8.C...8.C...8.C...8[D...8.D...8.D...8$E...8VE...8fE...8jE...8uE...8}E...8.E...8.E...8.E...8.E...8.E...8.E...8.E...8.E

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\lt.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	104357
Entropy (8bit):	5.634470665995158
Encrypted:	false
SSDEEP:
MD5:	3491FE5E5DDB518871416D36F177DA8E
SHA1:	FCBE343DDB9BB96DE4A88FC977AB5D24FB086E34
SHA-256:	ABC098128DF2ADDF98DA189C11C2D754617018AE0F243C575BCEEFA30B8F2016
SHA-512:	092CBADC4BF811B2AC97EB96C79F486A4AF6E133E9B18DB5815800DC105472A765EDE7997036BC9B553143A19F6E83296292DE734470C58D9A2726557B19F66C
Malicious:	false
Reputation:	unknown
Preview:	........r...j..0..k.-0..l.80..n.@0..o.E0..p.R0..q.X0..r.g0..s.x0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....1.....1.....1.....1....:1....H1....U1....i1....z1....\|1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2.....2.... 2....'2....02....:2....L2....Q2....[2....y2..*..2..+..2..,..2../..2..0..2..1..3..2..3..3.)3..4.I3..5.q3..6..3..7..3..>..4..?..4..N..4..g.-4..i.04..j.44..k.A4..l.L4..h8c4..i8k4..j8.4..k8.4..p8.4..q8.5..y8'5..z805..\|8D5...8N5...8b5...8u5...8.5...8.5...8.6...8.6...8.6...896...8h6...8.6...8d7...8.7...8.8...8D8...8\8...8.8...8.9...8.9...8.9...8.9...8.:...8.:...8.;...8.;...8.;...8.;...8.>...8b?...8w@...8.@...8.@...8.@...8.A...8.A...8%A...8fA...8.A...8.A...8EB...8tB...8.B...8.B...8GC...8.C...8.C...88D...8`D...8kD...8qD...8vD...8.D...8.D...8.D...8.D...8.D...8.D...8.D...8.E...8[E...8vE...8.E...8.E...8.E...8.E...8.E...8.E...8.F...8.J...8.J...8.K...8yK...8.K...8.K...8<L...8bL...8rL...8vL...8.L...8.L...8.L...8.L...8.L...8.L

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\lv.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	103112
Entropy (8bit):	5.642650382548857
Encrypted:	false
SSDEEP:
MD5:	296177539AC1A39C763F88EF9A32A423
SHA1:	DBD24E6E6EA7C141C5E37240756DA8ECF66DFF5F
SHA-256:	A084BD27DB3465F25481DF227AD26FC90D6AE65AFE68B191BFFC54C4BF43C3FE
SHA-512:	AD4CCE2405F07818BDC99A97FE8F30A0030FF99537E389BC922B8F13ACC3F3E23562E362FC11B6A8319771C8AB16D10A68B47561AB354230D9D1B2029025B461
Malicious:	false
Reputation:	unknown
Preview:	........{...j.00..k.?0..l.J0..n.R0..o.W0..p.d0..q.j0..r.y0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....1.....1.....1.....1.....1.....1....C1....V1....i1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.... 2....#2....$2.....2....92....A2....I2....P2....b2....j2....u2.....2....2..+..2..,..2../..2..0..2..1.03..2.A3..3.L3..4.b3..5..3..6..3..7..3..>..3..?..3..N..4..g..4..i..4..j..4..k.$4..l.,4..h814..i8:4..j8U4..k8u4..p8.4..q8.4..y8.5..z8.5..\|8!5...85...8>5...8M5...8.5...8.5...8.5...8.5...8.5...8.6...8,6...8.6...8.7...8.7...8.7...8.7...8.7...8.8...8.8...8d9...8x9...8.9...8.9...8D:...8.;...8.;...8&;...8K;...8]=...8L>...8.?...8X?...8y?...8.?...8.?...8.?...8.?...8.?...8.@...8@@...8.@...8.@...8.@...8.A...8]A...8.A...8.A...8.B...8LB...8XB...8bB...8jB...8nB...8.B...8.B...8.B...8.B...8.B...8.B...8.C...88C...8xC...8.C...8.C...8.C...8.C...8.C...8.D...8%D...8.D...8.G...8.G...8.G...8*H...8vH...8.H...8.H...8.I...8.I...8.I...8#I...8+I...8.I...84I...8?I

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\ml.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	232496
Entropy (8bit):	4.404148177181483
Encrypted:	false
SSDEEP:
MD5:	54AA3D2CB528E1DAC4B2B0021A5554DF
SHA1:	BEE1D9C974ACF78CB7EAC45643D3D4284A200562
SHA-256:	D8C52BF352B1E849087FA3183EE99CE7816C6FE6A7CB1C7C487C982DC84EDDAD
SHA-512:	CCF2FF836A5E589AC10E9293801512ED4E659E26B04C88452830581C0E639D4641A1A1360203403416FECA30F5BE9AB0AA6B86F19778C18E21FB30F4FF7FE4D6
Malicious:	false
Reputation:	unknown
Preview:	........s...j. 0..k./0..l.:0..n.B0..o.G0..p.T0..q.Z0..r.i0..s.z0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....1.....1.....1.....1....\|1.....1.....1....92.....2.....2.....2.....2.....2.....2....23....r3.....3.....3.....3.....3.....3.....4....&4....S4....n4.....4.....4.....4.....5....,5..*.\5..+._5..,..5../..5..0..5..1.p6..2..6..3..6..4..7..5.i7..6..7..7.E8..>..8..?..8..N..9..g./9..i.29..j.69..k.;9..l.O9..h8T9..i8f9..j8.9..k8.9..p8.:..q8u;..y8.;..z8.;..\|8.;...8.;...8$<...8X<...8.=...8]=...8.=...8.=...8.=...8E>...8.>...8.?...8.A...8UB...8.B...8.C...8DC...8.C...8.E...8RG...8iG...8.G...8WH...8.I...8.J...8.J...8-K...8.K...8bN...8uO...8TP...8$Q...8{Q...8.Q...8.Q...8.Q...8.R...8.R...8.S...8.T...80U...8VU...8.U...86V...8!W...8.W...8.X...8XY...8.Y...8.Z...8.Z...8$Z...8jZ...8.Z...8.Z...8.Z...89[...8<[...8.[...8.[...8.\...8.\...8.]...8-]...8.]...8.]...8.^...8_^...8#_...8.b...81c...8Yc...8.d...8We...8.e...8Hf...8.f...8.f...8.f...8.f...8.f...8.f...8.f...8.f...8.f

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\mr.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	189028
Entropy (8bit):	4.481714062823696
Encrypted:	false
SSDEEP:
MD5:	E6125DE2636D91AB5A398BBCEC54E4B7
SHA1:	CD1C85758CD1EA4D889EAA021C08B50E163A4513
SHA-256:	2C9B68038A192C51BCC88F3095C371FAD5F9F1430036D4E37C685BEAE19A29A3
SHA-512:	A00EF5CFD6D133D08266F1BAE3C8FF7A4827BC46AA98F62A849B8564DB2DB3C2F7B2A0661EBD0700A98926E51EF16C3B0C28B38A59C20C7706F4C91A6ABB6BE9
Malicious:	false
Reputation:	unknown
Preview:	........c...j..0..k..0..l..0..n."0..o.'0..p.40..q.:0..r.I0..s.Z0..t.c0..v.x0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0....k1.....1.....1.....1.....2.....2....!2....O2....e2.....2.....2.....2.....2.....3.....3.....3.....3....03....?3....j3....}3.....3.....3.....3.....3.....4..*.(4..+.+4..,.I4../..4..0..4..1..5..2.#5..3.<5..4.y5..5..5..6..6..7.L6..>..6..?..6..N..6..g..6..i..6..j..6..k..7..l..7..h8.7..i807..j8k7..k8.7..p8.8..q8.8..y8.8..z8.8..\|8.8...8.9...8B9...8k9...8>:...8.:...8.:...8.:...8.;...8W;...8.;...8.<...8.=...8.>...8.>...8;?...8j?...8.?...8.A...8.B...8.B...83C...8.C...8.E...8.E...8@F...8oF...8.F...8.I...8.J...8.K...8.K...8.K...8.L...8&L...88L...8dL...8.L...8.M...8.M...8.N...8.O...8]O...8.O...8.P...8rQ...8?R...8.R...8.S...87S...8YS...8hS...8tS...8.S...8.T...8@T...8AT...8jT...8mT...8.T...8.T...8oU...8.U...8.U...8.V...8CV...8UV...8lV...8.V...8JW...8.Z...8.Z...8.[...8.[...8.\...8.]...8d]...8.]...8.]...8.]...8.]...8.]...8.]...8.]...8.]

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\ms.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	90631
Entropy (8bit):	5.283371349101743
Encrypted:	false
SSDEEP:
MD5:	D153C90614A3A944176694DEB6C4C5FE
SHA1:	CCB4397AD0C601A2900DF0B280D77DD6DC88552F
SHA-256:	4431F80E1BD18FC4041B1B34B06C28F16591276CF3C18224270D7FE76DBE8A12
SHA-512:	38608CA71FC2F70E750CC8908D82787C3F60FD53D707D560A1A3CB4283DEA64AD98217D4D286A55D925F51284F40FBDFE3C7E0C4073F545AE1B09EEF2622DAC1
Malicious:	false
Reputation:	unknown
Preview:	........g...j..0..k..0..l."0..n.0..o./0..p.<0..q.B0..r.Q0..s.b0..t.k0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0.... 1....31....G1....a1....x1....z1....~1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2.....2....#2....(2.....2....:2....A2....H2....]2...k2..+.n2..,..2../..2..0..2..1..2..2..2..3..2..4..3..5.%3..6.a3..7.x3..>..3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..h8.3..i8.3..j8.3..k8.4..p8=4..q8.4..y8.4..z8.4..\|8.4...8.4...8.4...8.4...8.5...8:5...8F5...8N5...8U5...8n5...8.5...8.5...8`6...8.6...8.6...8.6...8.7...8&7...8.7...8W8...8f8...8v8...8.8...8.9...8h9...8\|9...8.9...8.9...8.:...8 ;...8.;...8.;...8.;...8.;...8.;...8.<...8.<...8,<...8v<...8.<...8.<...8.=...8.=...8?=...8.=...8.=...88>...8Z>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.?...8+?...8}?...8.?...8.?...8.?...8.?...8.?...8.?...8.@...8J@...8.A...8.B...8.B...8\|B...8.B...8.B...8.C...8<C...8LC...8PC...8[C...8`C...8cC...8iC...8sC...8vC

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\nb.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	89298
Entropy (8bit):	5.4262718114593325
Encrypted:	false
SSDEEP:
MD5:	3B440DB0C1D7B413165AD95F1C3C19B6
SHA1:	095D0EB86F2F87D70757B5A0BC1AD6F2495F8F08
SHA-256:	7AB0290EC676A8D403F149F89A35FE7B032CF5BD98AF6C5E5C63C4F0BA460E6D
SHA-512:	389F082A284605F01BBD8EA656288830D225051A5CD6CD7E7C45B83296607ACFC7F05AE1A1237A95A8B4A4DB56DDAF488B57D02F6EB855C1874BDC4E06D35826
Malicious:	false
Reputation:	unknown
Preview:	........q...j..0..k.+0..l.60..n.>0..o.C0..p.P0..q.V0..r.e0..s.v0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....1.....1.....1.....1....11....<1....K1....^1....u1....w1....{1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2....2...52..+.82..,.V2../.g2..0.l2..1..2..2..2..3..2..4..2..5..2..6..3..7.53..>.Q3..?.V3..N.b3..g.n3..i.q3..j.u3..k.\|3..l..3..h8.3..i8.3..j8.3..k8.3..p8.3..q824..y8:4..z8A4..\|8T4...8Y4...8m4...8y4...8.4...8.4...8.4...8.5...8.5...8.5...8C5...8.5...8'6...8.6...8.6...8.6...8.6...8.6...8H7...8.7...8.7...8.8...8.8...8.8...8.8...8.9...8.9...819...8.:...8.:...8.;...8H;...8f;...8l;...8t;...8{;...8.;...8.;...8.;...8.<...8.<...8.<...8.<...8.=...8a=...8.=...8.=...8.>...8N>...8U>...8[>...8^>...8r>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8:?...8L?...8e?...8m?...8.?...8.?...8.?...8.?...8.@...8~A...8.A...8.A...8.B...8XB...8}B...8.B...8.B...8.B...8.B...8.B...8.B...8.B...8.B...8.C...8.C

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\nl.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	93542
Entropy (8bit):	5.378472517881294
Encrypted:	false
SSDEEP:
MD5:	A30EEC9EA34FBD282F774F8734C8F6BA
SHA1:	75014371BA98B1D403D7CB9F82580842C54E5E28
SHA-256:	49C9A3FCB53E0E81D9FD19E7A902C7307B2FEDFCF2AF2BF7365857DA1ACC021E
SHA-512:	D24FF4439B81296C3287B9C30BE7DD798BC94B094E5C04F06902992004EAF2DE4E0F07F7A7E3F02CEA63FBFFF22AA5C8AD694334671B6F5FD6817D6DEB4A42AB
Malicious:	false
Reputation:	unknown
Preview:	........t...j."0..k.10..l.<0..n.D0..o.I0..p.V0..q.\0..r.k0..s.\|0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....1.....1.....1.....1.....1....>1....J1....Z1....k1....}1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2....#2....02....:2....A2....K2....\2....a2....h2....z2..*..2..+..2..,..2../..2..0..2..1..2..2..3..3..3..4.)3..5.B3..6.\|3..7..3..>..3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..h8.3..i8.3..j8.4..k8.4..p8I4..q8.4..y8.4..z8.4..\|8.4...8.4...8.4...8.4...8.5...8;5...8I5...8W5...8]5...8s5...8.5...8.6...8n6...8.6...8.6...8.7...8"7...867...8.7...8g8...8v8...8.8...8.8...8$9...8.9...8.9...8.9...8.9...8.:...8Y;...8.;...8.<...82<...8;<...8J<...8R<...8a<...8.<...8.<...8.<...8z=...8.=...8.=...8.=...80>...8w>...8.>...8.>...8.?...8(?...83?...88?...8<?...8T?...8n?...8.?...8.?...8.?...8.?...8.?...8.?...8.@...84@...8X@...8_@...8{@...8.@...8.@...8.@...8.A...8.B...8.B...8.B...8XC...8.C...8.C...8.C...8.D...8.D...8.D...8$D...8,D...8/D...85D...8?D

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\pl.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	100963
Entropy (8bit):	5.757917987320697
Encrypted:	false
SSDEEP:
MD5:	B0C6B7C7306197C340C9514F0AEC0ED6
SHA1:	85302361F3EA8DA3BB805444E83E0D809933CE31
SHA-256:	13A118EDC68E08E59C25A342101072C97FED8E90904883FAED71050728937FE7
SHA-512:	419C76DB396974495F31657D287531B171310AB6E39520600F6DEA340716C6FD9D6E0D2CCF027CEB0C8BBA3C6C3AF6C31BAF1EE513FD2D2A847285838EA4A197
Malicious:	false
Reputation:	unknown
Preview:	........v...j.&0..k.50..l.@0..n.H0..o.M0..p.Z0..q.`0..r.o0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....1.....1.....1.....1.....1....D1....S1....a1....v1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2....!2....+2....22....92....J2....P2....U2....o2..*.z2..+.}2..,..2../..2..0..2..1..2..2..3..3..3..4.63..5.T3..6..3..7..3..>..3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..i8.3..j8.4..k8.4..p8U4..q8.4..y8.4..z8.4..\|8.4...8.4...8.4...8.4...8?5...8`5...8o5...8.5...8.5...8.5...8.5...8I6...8.6...8(7...8I7...8}7...8.7...8.7...8.8...8.8...8.8...8.8...8&9...8.9...8F:...8V:...8c:...8.:...8a<...8O=...8.>...8>>...8e>...8k>...8z>...8.>...8.>...8.>...8.>...8.?...8.?...8.?...8.?...8.?...8+@...8x@...8.@...8.@...8.A...8.A...8$A...8,A...8/A...8BA...8]A...8wA...8xA...8.A...8.A...8.A...8.A...8.B...8(B...8CB...8LB...8nB...8tB...8.B...8.B...8#C...8.F...8&F...89F...8.F...8.F...8%G...8OG...8mG...8}G...8.G...8.G...8.G...8.G...8.G...8.G...8.G

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\pt-BR.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	95812
Entropy (8bit):	5.446634817144736
Encrypted:	false
SSDEEP:
MD5:	406327FB6D4B8E07B511D2015058444B
SHA1:	2318F774DE9D6682C22BD90EEC6C9DC629976BF9
SHA-256:	202907899EAB5AB6E2F34C5261B65D06B4A959CF68D5D33886BC8EA6F6A1E23E
SHA-512:	218FC6A683F3142659A8F8695FC4C1D2A76F8DAF504DA45B1A98D25B5BF488CB0E4A72570AF3887B1AF78009761B49C892B7E4F1E0AD10501B7763B773271AEE
Malicious:	false
Reputation:	unknown
Preview:	........x...j.0..k.90..l.D0..n.L0..o.Q0..p.^0..q.d0..r.s0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....1.....1.....1.....1.....1.....1....@1....R1....b1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2.....2....%2.....2....42....;2....K2....Q2....Y2....t2....2..+..2..,..2../..2..0..2..1..2..2..2..3..3..4.)3..5.B3..6.z3..7..3..>..3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..h8.3..i8.3..j8.4..k8.4..p8B4..q8.4..y8.4..z8.4..\|8.4...8.4...8.4...8.4...8.5...875...8D5...8V5...8`5...8.5...8.5...8 6...8.6...8.7...8"7...8E7...8S7...8l7...8.8...8.8...8.8...8.9...8;9...8.9...86:...8=:...8I:...8g:...8.;...8.<...8n=...8.=...8.=...8.=...8.=...8.=...8.>...8+>...8k>...8.>...8.?...8.?...8)?...8P?...8.?...8.@...8j@...8.@...8.@...8.@...8.@...8.@...8.@...8.A...8.A...8.A...8+A...8.A...8QA...8xA...8.A...8.A...8.A...8.A...8.B...8"B...8/B...8TB...8.B...8.D...8.D...8.D...8xE...8.E...8.E...8.F...82F...8BF...8FF...8QF...8YF...8\F...8bF...8lF...8oF

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\pt-PT.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	96586
Entropy (8bit):	5.429426980014273
Encrypted:	false
SSDEEP:
MD5:	41357EEA11638DBB92F44E1595433F8D
SHA1:	57CCD0D800CE9D7C38A41A032FB8D048E0D34F96
SHA-256:	CD58087D558F8EC827F4F8DBB54D4BB11062BB716B9EB0FC08D9D629CDFFAF52
SHA-512:	5BB671734D15B12ADEC4EA18EA127C81DE2118BB2A8C1A57BD927CDAA51ECF97B3BE77C9D3F40384BF2D31423579CFA49105656F3C93B3956D2DDC841DEFE475
Malicious:	false
Reputation:	unknown
Preview:	........z...j..0..k.=0..l.H0..n.P0..o.U0..p.b0..q.h0..r.w0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....1.....1.....1.....1.....1.....1....E1....X1....i1....~1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2.....2....'2....02....62....=2....N2....V2....^2....\|2....2..+..2..,..2../..2..0..2..1..2..2..3..3..3..4.73..5.[3..6..3..7..3..>..3..?..3..N..3..g..3..i..3..j..3..k..4..l..4..h8.4..i8.4..j894..k8F4..p8}4..q8.4..y8.4..z8.4..\|8.4...8.5...8 5...8/5...8u5...8.5...8.5...8.5...8.5...8.5...8!6...8.6...8.7...8w7...8.7...8.7...8.7...8.7...8.8...8g9...8~9...8.9...8.9...8N:...8.:...8.:...8.:...8.;...8<...8.<...81=...8s=...8.=...8.=...8.=...8.=...8.=...8.=...8T>...8.>...8.>...8.?...8%?...8e?...8.?...8.@...8]@...8.@...8.@...8.@...8.@...8.@...8.@...8.A...8.A...8.A...8/A...8@A...8CA...8sA...8.A...8.A...8.B...88B...8BB...8_B...8eB...8rB...8.B...8.B...8.D...8.D...8.D...8^E...8.E...8.E...8.E...8.F...8,F...80F...8;F...8CF...8FF...8LF...8VF

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\ro.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	98910
Entropy (8bit):	5.4746357373073655
Encrypted:	false
SSDEEP:
MD5:	22535F6BAE4ECFF3BFFC3718580E9599
SHA1:	E7AA8B69713ACF0519589BE8E0BDE0E527279E03
SHA-256:	2409CA23765892465265B09730093FF475C32BD27ADE0B9F62E8CA4D27B71624
SHA-512:	FB928449DC9C47ABC0B02B647B70387E3A9BDC6D39FFB140B4ED3F70B0B3ECDA553E4144D848013439E066CF9D2996518AABA99CB3DACDADF6A11AD99674A018
Malicious:	false
Reputation:	unknown
Preview:	........\|...j.20..k.A0..l.L0..n.T0..o.Y0..p.f0..q.l0..r.{0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....1.....1.....1.....1.....1.....1.... 1....[1....j1....v1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2....$2....'2....(2....42....@2....M2....U2....^2....n2....u2....}2.....2..*..2..+..2..,..2../..2..0..2..1..3..2.03..3.;3..4.W3..5.w3..6..3..7..3..>..3..?..3..N..3..g..4..i..4..j..4..k..4..l..4..h8.4..i8(4..j8;4..k8L4..p8t4..q8.4..y8.4..z8.4..\|8.4...8.4...8.5...8.5...8^5...8.5...8.5...8.5...8.5...8.5...8.5...8m6...8.6...8=7...8Q7...8z7...8.7...8.7...8.8...8.8...8.8...8.8...8.9...8.9...8):...84:...8E:...8e:...8.;...8.<...8.=...8P=...8t=...8.=...8.=...8.=...8.=...8.>...8;>...8.>...8.>...8.>...8.>...8S?...8.?...8.?...8.@...8C@...8N@...8S@...8U@...8k@...8.@...8.@...8.@...8.@...8.@...8.@...8.@...81A...8IA...8_A...8fA...8.A...8.A...8.A...8.A...8;B...8_D...8zD...8.D...8.E...8KE...8yE...8.E...8.E...8.E...8.E...8.E...8.E...8.E...8.E...8.E...8.E...8.F

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\ru.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	156213
Entropy (8bit):	5.009668050397232
Encrypted:	false
SSDEEP:
MD5:	8DECCB7783FCB621E42179A461BFE51A
SHA1:	C1C91EFCDF03E7578A37C3A9506BD148ECFD8DBC
SHA-256:	5535F872950EB70B7F9F40B1A5CB4DF67DA1FBA08775B4FFC3B89DC704A897BE
SHA-512:	ADAE4F840F0CFECBDE8295A27D4C5C80BC92603397D586AA024139EA35DC9BC0BC54E79E30CFFB44B003F40D82E710907F40A73CC3459461EC92902D961B6EF6
Malicious:	false
Reputation:	unknown
Preview:	........^...j../..k..0..l..0..n..0..o..0..p.0..q.00..r.?0..s.P0..t.Y0..v.n0..w.{0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0....<1....Y1....v1.....1.....1.....1.....1.....1.....1.....1.....2....42....R2....t2....{2....~2.....2.....2.....2.....2.....2.....2.....2.....3.....3....<3...M3..+.P3..,.n3../..3..0..3..1..3..2..4..3.#4..4.V4..5..4..6..4..7.!5..>.O5..?.^5..N.}5..g..5..i..5..j..5..k..5..l..5..h8.5..i8.5..j8.5..k8.5..p8f6..q8.6..y8.7..z8.7..\|8:7...8L7...8j7...8.7...8.7...8,8...8I8...8Y8...8e8...8.8...8.8...8.9...8.:...89;...8];...8.;...8.;...8.;...8.<...8 >...89>...8Y>...8.>...8.?...8.@...8.@...8.@...8QA...8WE...8.F...8.H...8kH...8.H...8.H...8.H...8.H...8;I...8.I...8.J...8.J...8.J...8.K...8GK...8.K...8:L...8.L...8.M...8eM...8{M...8.M...8.M...8.M...8.M...8.N...8.N...8BN...8EN...8.N...8.N...8.O...8:O...8fO...8wO...8.O...8.O...8.O...8.P...8vW...8.W...8.W...8'X...8.X...8.X...8.Y...8=Y...8MY...8QY...8\Y...8dY...8gY...8mY...8wY...8zY...8.Y...8.Y

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\sk.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	102315
Entropy (8bit):	5.79926220582958
Encrypted:	false
SSDEEP:
MD5:	022E1EE505FAEABBA98EA21A65103C64
SHA1:	F7C9F5A991FCD87FB942AAC40FC7170F1C86363B
SHA-256:	C26E5579EFEDFC9AEF52B130677A10DFFED2E64AC3CF77918783CA167A4EE11F
SHA-512:	6A21A3031E8B33C9F1D512E089BF1E473DFB735B36549C611E21579B57EE8CE89F93752B637673F72456C8F3ADD30C2DD8F5F6C44DE1024C44E919CC5B93DE97
Malicious:	false
Reputation:	unknown
Preview:	........}...j.40..k.C0..l.N0..n.V0..o.[0..p.h0..q.n0..r.}0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....1.....1.....1.....1.... 1....!1...."1....V1....j1....r1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2.....2....-2....52....=2....I2....Y2....`2....z2..*..2..+..2..,..2../..2..0..2..1..2..2..3..3..3..4.33..5.R3..6..3..7..3..>..3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..h8.3..i8.4..j854..k8I4..p8{4..q8.4..y8.4..z8.4..\|8.4...8.4...8.5...8.5...8`5...8.5...8.5...8.5...8.5...8.5...8.5...8x6...8.6...8H7...8]7...8.7...8.7...8.7...8@8...8.9...8.9...8%9...8\9...8.9...8.:...8.:...8.:...8.:...8.<...8.=...8.>...8.>...8.>...8.>...8.?...8.?...8!?...8N?...8.?...8.?...8?@...8X@...8f@...8.@...8.@...86A...8.A...8.A...8.A...8.A...8.A...8.A...8.A...8.B...8)B...8BB...8CB...8XB...8[B...8.B...8.B...8.C...8#C...8;C...8DC...8dC...8lC...8.C...8.C...8%D...8.G...8.G...8.G...8hH...8.H...8.H...80I...8bI...8rI...8vI...8.I...8.I...8.I...8.I...8.I...8.I

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\sl.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	97837
Entropy (8bit):	5.499956002880514
Encrypted:	false
SSDEEP:
MD5:	052A9D575A32F8F67D928180E4C11658
SHA1:	1DFBC1CD6B52C9CF1EC643F98D2F78E94E161A11
SHA-256:	3CC8D12187D16A72D9146B11AA5D37EC95BE55136CB253C6BB59B2E6E027E1F0
SHA-512:	8D6C58518022E5DE2B518D138AB14EAEB58AFBF18C475DA71B697310B7DC2331F10940ED65891A591110DC8DE181F311F999E33B1D13A93351E408B91CF60EB0
Malicious:	false
Reputation:	unknown
Preview:	........j...j..0..k..0..l.(0..n.00..o.50..p.B0..q.H0..r.W0..s.h0..t.q0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0....&1....81....F1....V1....i1....k1....o1....y1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2.....2....#2....>2..*.J2..+.M2..,.k2../..2..0..2..1..2..2..2..3..2..4..3..5..3..6.a3..7.y3..>..3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..i8.3..j8.3..k8.4..p8/4..q8x4..y8.4..z8.4..\|8.4...8.4...8.4...8.4...8.5...8?5...8S5...8e5...8m5...8.5...8.5...8.6...8.6...8.6...8.7...837...8B7...8V7...8.7...8Y8...8k8...8.8...8.8...859...8.:...8):...88:...8T:...8.=...8.=...8.>...8)?...8J?...8S?...8_?...8i?...8\|?...8.?...8.?...8.@...8\@...8m@...8.@...8.@...8.A...8PA...8.A...8.A...8.A...8.A...8.A...8.A...8.A...8.B...8!B...83B...84B...8FB...8IB...8rB...8.B...8.B...8.C...8.C...8!C...8AC...8FC...8SC...8zC...8.D...8.G...8.G...8.G...8%H...8mH...8.H...8.H...8.H...8.I...8.I...8.I...8.I...8.I...8%I...8/I...82I

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\sr.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	146803
Entropy (8bit):	4.954795402580545
Encrypted:	false
SSDEEP:
MD5:	9B855E0C0EA4ED7D85F9AF6A5D255F97
SHA1:	2CA357DAFE2E702CD2724F5FA83DAA6366EC63B7
SHA-256:	51807B20F03F3DAA9DCD941B6ABABBBCF8638B622FA30F70B1E74514A4F1F649
SHA-512:	00178E7B4428C61EDFAA74EDEDDC1D46A1FDB12B974FE9FAE302394D0DFF0E08C16F019DBE86F8B91C26A09421D72C6F94D706952D5BE15F61012B5AC5CA43EB
Malicious:	false
Reputation:	unknown
Preview:	........}...j.40..k.C0..l.N0..n.V0..o.[0..p.h0..q.n0..r.}0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....1.....1.....1.....1.... 1....!1...."1....q1.....1.....1.....1.....2.....2.....2....,2....C2....\2....}2.....2.....2.....2.....2.....2.....2.....2.....2.....3....&3....53....K3....U3....e3.....3..*..3..+..3..,..3../..3..0..3..1.^4..2.u4..3..4..4..4..5..4..6.g5..7..5..>..5..?..5..N..5..g..6..i..6..j..6..k..6..l..6..h8$6..i866..j8l6..k8.6..p8.6..q8_7..y8o7..z8}7..\|8.7...8.7...8.7...8.7...8{8...8.8...8.8...8.9...8"9...8S9...8.9...8U:...8.:...8.;...8.;...8.;...8.<...82<...8.<...8.=...8.>...88>...8.>...8h?...8y@...8.@...8.@...8.@...8.D...8HE...8.F...8#G...8XG...8dG...8.G...8.G...8.G...8.G...8PH...8.H...8BI...8kI...8.I...8.I...8hJ...8.J...8fK...8.K...8.K...8.K...8.L...8.L...8.L...8?L...8eL...8.L...8.L...8.L...8.L...8.L...8AM...8.M...8.M...8.M...8.M...8.N...8%N...87N...8sN...8HO...8.T...8JT...8eT...8!U...8.U...8.U...8/V...8uV...8.V...8.V...8.V...8.V...8.V...8.V...8.V

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\sv.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	89307
Entropy (8bit):	5.530038375090032
Encrypted:	false
SSDEEP:
MD5:	9C321B7491059AC968C6821E484B8120
SHA1:	26EEF827CE1A0975603839436808B3810C78C7E6
SHA-256:	52EF2C2DBEFC132520BFF8B30D64376070BB582D66A0F61452418E21F654FE63
SHA-512:	BF57CE8033012AC698398077B86956C8DCBE4C022088DFF748ED660D5DA50FB53F0FC70646810ECF10B5C4E8430C7DD8ABEE0D71EEDAA5278FCF7A14F7580E1B
Malicious:	false
Reputation:	unknown
Preview:	........p...j..0..k.)0..l.40..n.<0..o.A0..p.N0..q.T0..r.c0..s.t0..t.}0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....1.....1.....1....21....C1....U1....i1....}1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2....!2....(2....72..*.?2..+.B2..,.`2../.l2..0..2..1..2..2..2..3..2..4..2..5..3..6.;3..7.M3..>.]3..?.f3..N.v3..g..3..i..3..j..3..k..3..l..3..h8.3..i8.3..j8.3..k8.3..p8.4..q8F4..y8N4..z8S4..\|8e4...8j4...8.4...8.4...8.4...8.4...8.5...8.5...8.5...885...8f5...8.5...8,6...8.6...8.6...8.6...8.6...8.7...8.7...838...8E8...8T8...8.8...8.8...8P9...8Y9...8f9...8.9...8q:...8.:...8u;...8.;...8.;...8.;...8.;...8.;...8.;...8.<...8k<...8.<...8.<...8.=...8.=...88=...8.=...8.=...8.>...8@>...8d>...8m>...8v>...8\|>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.?...86?...8.?...8.?...8.?...8.?...8.?...8.?...8.?...8.@...8r@...8.A...8.A...8.A...8EB...8.B...8.B...8.B...8.C...8.C...8.C...8%C...8-C...80C...86C...8@C

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\sw.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	90948
Entropy (8bit):	5.376857793458875
Encrypted:	false
SSDEEP:
MD5:	E2D811AD5123EEE00181198C18B0E8EA
SHA1:	07E93FEDD2A3367B356E45EF1048105AB32158A1
SHA-256:	B7F8CDFA1A3615B0BF948A904B2F0DF797EF64B9CE88C3E22E09695C024D8ED8
SHA-512:	F625357BD175DC56D754B0EDF37DD56334CB912F53F5E5397E874E1FB4957F1EF823217FCA8DB83AAF312E3AABC4622751810B4144165837C66926B7A5095ABC
Malicious:	false
Reputation:	unknown
Preview:	........g...j..0..k..0..l."0..n.0..o./0..p.<0..q.B0..r.Q0..s.b0..t.k0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....1....,1....<1....P1....g1....i1....m1....s1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2....%2....2....J2..*.U2..+.X2..,.v2../..2..0..2..1..2..2..2..3..2..4..3..5.(3..6.`3..7.w3..>..3..?..3..N..3..g..3..i..3..j..3..k..3..l..3..h8.3..i8.3..j8.4..k8.4..p8O4..q8.4..y8.4..z8.4..\|8.4...8.4...8.4...8.4...8=5...8o5...8.5...8.5...8.5...8.5...8.5...8B6...8.6...847...8K7...8{7...8.7...8.7...8E8...8.9...8.9...8,9...8a9...8.9...84:...8E:...8X:...8\|:...8.;...8.<...8w<...8.<...8.<...8.<...8.<...8.<...8.=...8&=...8s=...8.=...8.>...8.>...8+>...8Y>...8.>...8.?...8N?...8q?...8.?...8.?...8.?...8.?...8.?...8.?...8.?...8.?...8.@...8.@...89@...8Y@...8.@...8.@...8.@...8.@...8.@...8.A...8.A...81A...8yA...8.B...8.B...8.B...8JC...8.C...8.C...8.D...8-D...8=D...8AD...8LD...8RD...8UD...8[D...8eD...8hD

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\ta.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	226902
Entropy (8bit):	4.213485778062286
Encrypted:	false
SSDEEP:
MD5:	1E05E82845CA768066045B741DC17C25
SHA1:	3742BE7FA7FAEF1A58AD7B526C6D23AB1B0EE3C9
SHA-256:	4EA70CBE5FED7813502BE5BF08D2E818CFF04827136BD935D873E28CA42C0A9B
SHA-512:	C60FF659B3421E9612A11F2FCD05E8A323717AE9293A3AFA6F319312097841763DBB8392ADE983EAE83B70A98EA6E97F0C4301213332B5877BEB94733D1EC8D9
Malicious:	false
Reputation:	unknown
Preview:	........k...j..0..k..0..l.0..n.20..o.70..p.D0..q.J0..r.Y0..s.j0..t.s0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....1.....1.....1....42.....2.....2.....2.....2.....2.....2....73....z3.....3.....3.....3.....3.....3.....4....4....?4....K4....^4.....4.....4.....4....%5..*.I5..+.L5..,.j5../..5..0..5..1.P6..2..6..3..6..4..6..5..7..6..8..7.`8..>..8..?..8..N..9..g..9..i..9..j.#9..k.(9..l.69..h8;9..i8M9..j8.9..k8.9..p8J:..q8(;..y8@;..z8R;..\|8};...8.;...8.;...8.;...8.<...8.=...8F=...8w=...8.=...8.=...8~>...8.@...8.A...8XB...8.B...8.C...8qC...8.C...8#E...8SG...8jG...8.G...8[H...8.I...8.J...8.K...8gK...8.K...8oN...8.O...8.P...8.Q...8.R...8 R...8TR...8iR...8.R...8.R...8.S...8ET...84U...8sU...8.U...8jV...8.W...8eX...8;Y...8.Y...8&Z...8PZ...8eZ...8tZ...8.Z...8.Z...8.[...8C[...8D[...8r[...8u[...8.[...81\...8,]...8g]...8.]...8.]...88^...8P^...8v^...8.^...8._...8.d...8Yd...8{d...8.e...8ef...8.f...8<g...8.g...8.g...8.g...8.g...8.g...8.g...8.g...8.g

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\te.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	210749
Entropy (8bit):	4.418934036596949
Encrypted:	false
SSDEEP:
MD5:	AB1991435E9E71F1735DD2529E89E9B9
SHA1:	E21582302C08685A3AEBA25FA3E823244825D73D
SHA-256:	9318FE32F0B20056D66C32A70F193E0DBF38540714F9D2F5F8D30663DF1E1D2B
SHA-512:	0400AEABB3F2026A7B4A20FB8DA11234516C4829CD433759D1613C272F44C8C67801017E446E03A4B5A627E4D95A91D09B350F518DF7CAAC220A90A21A582981
Malicious:	false
Reputation:	unknown
Preview:	........\|...j.20..k.A0..l.L0..n.T0..o.Y0..p.f0..q.l0..r.{0..s..0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....1.....1.....1.....1.....1.....1.... 1.....1.....1.....2....H2.....2.....2.....2.....2.....2.....3....93....[3.....3.....3.....3.....3.....3.....3.....4....E4....]4....j4.....4.....4.....4.....5..*.15..+.45..,.R5../..5..0..5..1.>6..2.[6..3..6..4..6..5.#7..6..7..7..7..>.48..?.G8..N..8..g..8..i..8..j..8..k..8..l..8..h8.8..i8.8..j839..k8]9..p8.:..q8.:..y8.;..z8.;..\|8A;...8Z;...8.;...8.;...8.<...8.<...8.=...8a=...8.=...8.=...80>...8P?...8X@...8}A...8.A...8.A...8,B...8.B...8>D...8?F...8VF...8.F...8'G...8.H...8ZI...8.I...8.I...8/J...8qL...8\M...8:N...8.O...8hO...8.O...8.O...8.O...8.P...8jP...8AQ...8.Q...8.R...8.S...8YS...8.S...8.T...8aU...81V...8.V...8.V...8.V...8.W...8.W...84W...8.W...8.W...8.X...8.X...8`X...8cX...8.X...8.Y...8.Y...8.Y...8PZ...8rZ...8.Z...8.Z...8.Z...8`[...87\...8._...8._...8._...8.a...8.a...8"b...8.b...8.b...8#c...8'c...8Lc...8ac...8dc...8jc...8tc

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\th.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	181793
Entropy (8bit):	4.497287946485233
Encrypted:	false
SSDEEP:
MD5:	AB99EEDF367DA503E9B0982547E8A3A2
SHA1:	DDFE2A88E18EBFB4139C6D8A413B26F429CE4F14
SHA-256:	86CEBC8D93BC6B636B135E03CA32B049D0A7A843194C75CA48D25430C8C7EC77
SHA-512:	1150F32B44884C85FCD8588A4953481326655BDD9B908D513B4FD3C0D39CD11E660BBE6BBA1E6F4E34F5E6C5A490BCF5BF3CA6628873415EC48930E1B9E28356
Malicious:	false
Reputation:	unknown
Preview:	........R...j../..k../..l../..o../..p..0..q..0..r..0..s..0..t.70..v.L0..w.Y0..y._0..z.n0..\|.t0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....1....A1....k1.....1.....2.....2.....2.....2....42....g2.....2.....2.....2.....2.....2.....2.....2.....3.....3....$3....I3....U3....g3.....3..*..3..+..3..,..3../..4..0..4..1..4..2..4..3..4..4..5..5.c5..6..5..7..6..>.G6..?.x6..N..6..g..6..i..6..j..6..k..6..l..6..h8.6..i8.6..j8&7..k8G7..p8.7..q8W8..y8s8..z8.8..\|8.8...8.8...8.9...899...8.9...8!:...8N:...8o:...8.:...8.:...8.;...8.<...8%=...8X>...8.>...8.>...8.>...8 ?...8k@...8.B...8+B...8[B...8.B...8.C...8aD...8.D...8.D...8.D...8wG...8uH...8EI...8.I...8.J...8#J...85J...8SJ...8nJ...8.J...8>K...8.K...8}L...8.L...8.L...8.M...8.M...8.N...8.O...8qO...8.O...8.O...8.O...8.O...8%P...8\|P...8.P...8.P...8.P...8.P...8.P...8.Q...8.Q...8.Q...8.Q...8.R...8[R...8jR...8~R...8.R...8NS...8.V...8.V...8.W...8.X...8.X...8/Y...8.Y...8.Y...8.Z...8.Z...8.Z...8.Z...8.Z...8$Z...8.Z...81Z...8;Z...8>Z

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\tr.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	94187
Entropy (8bit):	5.64553424655566
Encrypted:	false
SSDEEP:
MD5:	54AC3B3AF173B25578E9AAF24BC98397
SHA1:	508F326895F8BD64D97B8E22730DF1F0B9136D23
SHA-256:	09146F4A345A514D1F8038618E03CC483D4052576BAFEF42AA4914FF6B601670
SHA-512:	6B08C4732CD827B7EFCFDCCF6C288B07CE8265A03AF5B8CB44888E5320C06F073F07AEFF5A4EC82A6F9431FA09A0C9B4472A12DC416AD8143C5AF84F33418A99
Malicious:	false
Reputation:	unknown
Preview:	........u...j.$0..k.30..l.>0..n.F0..o.K0..p.X0..q.^0..r.m0..s.~0..t..0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....1.....1.....1.....1.....1....M1....e1....{1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....2....#2....2....-2.....2....F2....M2....X2....]2....e2....t2....x2....~2.....2....2..+..2..,..2../..2..0..2..1..3..2..3..3.,3..4.B3..5.e3..6..3..7..3..>..3..?..3..N..3..g..4..i..4..j..4..k..4..l..4..h8.4..i8'4..j8A4..k8R4..p8.4..q8.4..y8.5..z8.5..\|8.5...8.5...825...8?5...8.5...8.5...8.5...8.5...8.5...8.5...8.6...8.6...8.6...8.7...807...8?7...8X7...8.7...8.8...8.8...8.8...8.9...8.9...8.9...8.9...8.:...8.:...8g;...8.;...85<...8u<...8.<...8.<...8.<...8.<...8.<...8.<...85=...8V=...8.=...8.=...8.=...85>...8.>...8.>...8(?...8N?...8w?...8}?...8.?...8.?...8.?...8.?...8.?...8.?...8.?...8.?...8.?...8.@...8/@...8.@...8.@...8.@...8.@...8.@...8.@...8.@...8.A...8qA...8.B...8.B...8.C...8.C...8.C...8.D...81D...8WD...8gD...8kD...8vD...8~D...8.D...8.D...8.D...8.D

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\uk.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	156936
Entropy (8bit):	5.041414148208884
Encrypted:	false
SSDEEP:
MD5:	8451540E681333E67E9E7D68C0B2835B
SHA1:	BC7A27A0211871641940278F39D83DB89C4912CC
SHA-256:	8F88A5BEF8AFBA06FBA8DC8BD538B04550495C1B3BC384ACE4451250DB9713F3
SHA-512:	80C0112E55BB9C6E0E004A163C2C84B7AC903726C7B91D62DD4D879171BA570A4924E5B3F5D1515D87B26193E52B79FE95F878BB989321E4C90A49120CAF9D43
Malicious:	false
Reputation:	unknown
Preview:	........n...j..0..k.%0..l.00..n.80..o.=0..p.J0..q.P0..r._0..s.p0..t.y0..v..0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....1.....1.....1....j1.....1.....1.....1.....2.....2.....2....$2....;2....O2....r2.....2.....2.....2.....2.....2.....2.....2.....3.....3....3....=3....S3....]3....o3.....3....3..+..3..,..3../..4..0.'4..1..4..2..4..3..4..4..4..5.*5..6..5..7..5..>..5..?..5..N..6..g..6..i..6..j..6..k..6..l.(6..h8-6..i8A6..j8_6..k8.6..p8.6..q8m7..y8}7..z8.7..\|8.7...8.7...8.7...8.7...8w8...8.8...8.8...8.9...8.9...8@9...8.9...8.:...8d;...8.;...8.;...8.<...8K<...8&=...8e>...8.>...8.>...8.>...8.?...8qA...8~A...8.A...8.A...8.E...8.G...8xI...8.I...8.I...8.J...84J...8MJ...8jJ...8.J...84K...8wK...8.L...8BL...8nL...8.L...8rM...8.M...8eN...8.N...8.O...8.O...8:O...8@O...8wO...8.O...8.O...8.O...8.O...8.O...88P...8rP...8.P...8.Q...8KQ...8ZQ...8.Q...8.Q...8.Q...8.Q...8.R...8'Y...8\Y...8wY...87Z...8.Z...8.[...8^[...8.[...8.[...8.[...8.[...8.[...8.[...8.[...8.[...8.[...8.[

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\vi.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	110870
Entropy (8bit):	5.821906933652033
Encrypted:	false
SSDEEP:
MD5:	D36508C839E88C94D06D13BC180A6728
SHA1:	3D246DD877A12BEB3C2552B017F3BD949A09956B
SHA-256:	F96A6E27114B97FF6CFF59E4AAEBEA8D0B4DF47AC385491AF26BF2999F8B4B40
SHA-512:	FF2062FE98B7938A91537A576B869AB87AAC0617DDC121B4E8A3332F034940B36961EF8D52C7933443D13D04E3B167DC9B0E080DE5894829FAF982CAE680EDCC
Malicious:	false
Reputation:	unknown
Preview:	........a...j../..k..0..l..0..n..0..o.#0..p.00..q.60..r.E0..s.V0..t._0..v.t0..w..0..y..0..z..0..\|..0..}..0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....1.....1..../1....X1....w1....y1....}1.....1.....1.....1.....1.....1.....1.....1.....2.....2.....2.....2.....2....(2.....2....82....J2....T2....c2.....2....2..+..2..,..2../..2..0..2..1..3..2..3..3.#3..4.?3..5.T3..6..3..7..3..>..3..?..3..N..4..g..4..i..4..j..4..k..4..l..4..h8$4..i804..j8R4..k8b4..p8.4..q8-5..y8>5..z8N5..\|8f5...8j5...8u5...8.5...8.5...8$6...836...8C6...8G6...8^6...8.6...8#7...8.7...818...8A8...8u8...8.8...8.8...8M9...8=:...8[:...8n:...8.:...8);...8.;...8.;...8.;...8.;...8.=...8.=...8%>...8n>...8.>...8.>...8.>...8.>...8.>...8.>...8@?...8h?...8.?...8.?...8.@...87@...8.@...8&A...8.A...8.A...8.A...8.A...8.A...8.A...8.A...8.B...8BB...8XB...8YB...8kB...8nB...8.B...8.B...8.C...8C...8VC...8nC...8.C...8.C...8.C...8.C...8.D...8)F...8oF...8.F...8.G...8[G...8.G...8.G...8.G...8.H...8.H...8.H...8#H...8&H...8,H...86H

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\zh-CN.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	82758
Entropy (8bit):	6.718765096437211
Encrypted:	false
SSDEEP:
MD5:	311CA2D3E7B6F8E41275D6E5BF3FCF1A
SHA1:	7C989745F3BD799BE2B0D1CE840F7A15D61D22CC
SHA-256:	7079B08504EE73E9585DDB32B05ECBC02FE3F03AB0229A5F9849D51C947F7908
SHA-512:	5315B62B1B43F317539515D790AF22B4B438B908F3B13CBEEE0346141133491A04A2C6A42B129E6C5E7CD04DC1474E29514A6BB37E1A854736ECFC38C68536AA
Malicious:	false
Reputation:	unknown
Preview:	........L...j../..k../..l../..m../..o../..p../..q..0..r..0..s.!0..t.0..v.?0..w.L0..\|.R0..}.d0....l0....t0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....1.....1.....1.... 1....&1....21....>1....J1....\1....p1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1....1..+..1..,..2../.02..0.E2..1.i2..2.z2..3..2..4..2..5..2..6..2..7..3..>..3..?.,3..N.D3..g.Q3..i.T3..j.X3..k.]3..l.f3..h8k3..i8q3..j8.3..k8.3..p8.3..q8.4..y8+4..z844..\|8F4...8L4...8[4...8g4...8.4...8.4...8.4...8.4...8.5...8.5...875...8.5...816...8.6...8.6...8.6...8.6...8.7...8.7...8B8...8S8...8k8...8.8...8.8...8o9...8{9...8.9...8.9...8k:...8.:...87;...8m;...8.;...8.;...8.;...8.;...8.;...8.;...8+<...8I<...8.<...8.<...8.<...8.=...8{=...8.=...8.>...8E>...8o>...8u>...8{>...8~>...8.>...8.>...8.>...8.>...8.>...8.>...8.>...8.?...83?...8.?...8.?...8.?...8.?...8.?...8.?...8.?...8.?...8F@...8.A...8.B...8.B...8kB...8.B...8.B...8.C...8%C...85C...8DC...8OC...8WC...8ZC...8`C...8jC...8mC...8wC

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\locales\zh-TW.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	82982
Entropy (8bit):	6.718646638109085
Encrypted:	false
SSDEEP:
MD5:	49551908E78EB54D5538D9A1D9B52EB5
SHA1:	2EE5F5C0139FA399B268D2446233F9BDCF2FA91B
SHA-256:	61C4AA03F3A1C8BE949F9F98E3079C5BF103C3A7CABB69047E2997C9DDF5312F
SHA-512:	2476F9D979C0CE4E17C2E74FF99E71FEF7C49FD769B06AEE97A8DF349566E056AA2938A8A0088B846FF676E9484C0F8A7097065FF5340FB24D2459902C0A7155
Malicious:	false
Reputation:	unknown
Preview:	........K...j../..k../..l../..n../..o../..p../..q..0..r..0..s.%0..t..0..v.C0..w.P0..y.V0..z.e0..\|.k0..}.}0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....0.....1.....1.... 1....$1....1....31....?1....Q1....c1....w1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1.....1....1..+..2..,.12../.F2..0.O2..1.s2..2..2..3..2..4..2..5..2..6..3..7..3..>..3..?.83..N.M3..g.Z3..i.]3..j.a3..k.h3..l.p3..h8u3..i8{3..j8.3..k8.3..p8.3..q8&4..y884..z8>4..\|8J4...8P4...8e4...8q4...8.4...8.4...8.5...8.5...8.5...8)5...8J5...8.5...8;6...8.6...8.6...8.6...8.6...8.7...8.7...8<8...8M8...8b8...8.8...8.8...8[9...8j9...8v9...8.9...8W:...8.:...8);...8Y;...8q;...8w;...8.;...8.;...8.;...8.;...8.<...8.<...8.<...8.<...8.<...8.<...8==...8.=...8.=...8.=...8$>...8*>...80>...83>...86>...8N>...8l>...8.>...8.>...8.>...8.>...8.>...8.>...8%?...89?...8H?...8T?...8o?...8u?...8.?...8.?...8.?...8.A...8.A...8.A...8.B...8ZB...8.B...8.B...8.B...8.B...8.B...8.B...8.B...8.C...8.C...8.C...8.C...8.C

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources.pak Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	4329630
Entropy (8bit):	7.990525634727587
Encrypted:	true
SSDEEP:
MD5:	977BDF44C3BD2FA5ECE6F23915A7ACC6
SHA1:	DF371EDC31EB80FE0899447DEAC2921F519C8CC5
SHA-256:	2FE8DD43B377A908DF6454EC3005B3E25409A82BFB45C35BA871F05CC578C21E
SHA-512:	D437BCC48BEC3AD66A5CD0E6D6C3948276B897F6ECA034B3C221EA1DC00FE7B27425D1491A1634B6AC843FC1F12AECD20BF2A7DA5FE8023AAC824ADC0F791639
Malicious:	false
Reputation:	unknown
Preview:	............f.....h.."....."....."..4+.%..7+#1..:+.3..;+.3..<+.6..=+.?..>+=I..?+.J..@+.L..A+.`..B+.t..C+.}..D+>...E+....F+...G+...H+....I+8...J+....K+&...L+....M+....N+....o+....p+....q+....r+r...s+0...t+....u+....v+....w+....x+....y+...z+65..{+.\..\|+6d..}+.o..~+.s...+x....+.....+.....+[....+.....+?....+a....+!....+m....+....+....+.....+.....+.....+.....+}....+.....+.....+m....+-....+.....+.....+.....+1....+....+.V...+y^...+.u...+....+....+.....+.....+p....+....+=....+....+.....+.....+=....+.....+.....+4....+Y....+....+....+.....-.....-0...n-.2..o-04..p-.B...3.G...3.Q...3gp...3.x...3.....3u....3Z....3.....3M....3....3o....3.... 3....!3...."3+#..#3.&..$3.)..%3.+..&3....'3./..(3.4..)3.=..3.?..+34J..,3.Q..-3VY..PA![..QA.B..RA.D..SA.I..TA.Z..UA{...VA4...WA....XA....YA....ZA....[A....\A."..]A.9..^A.G..hA....iA."..jAu'..kA.+..lAN-..mA.7..nA.A..oA]D..pA....qA....rAl...sA....tAJ...uA....vA....wA....xA....yA....zA....{AI...\|A...."B....#B....$BD...%BR...&BV ..'B."..(B.$..)B.%..*B.'

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\.gitignore Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.8042292966721747
Encrypted:	false
SSDEEP:
MD5:	49D9E9FC0F17772A3D849F0BA6D78598
SHA1:	524F020615A2D48E543AA42BD6BFBE0E1F35E962
SHA-256:	2608F2AB98654B1CEF3AD58D6211EFD2336EEFAA8F14E75E8A4344204D15C687
SHA-512:	205B539C11B1F0EA7E00C9C701784D1E19531B9040741D568A34C039B33184A86A7E3D6DBA7733D792AC81011AF09CB4793B9AD35021369F1E5A3911D2FEF846
Malicious:	false
Reputation:	unknown
Preview:	.DS_Store.node_modules.out.dist.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\5835243bf2fd8a85-SHA2.pfx Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	4406
Entropy (8bit):	7.912021942468378
Encrypted:	false
SSDEEP:
MD5:	D9980E18BCD0BF719B560FF088CDC909
SHA1:	22F0656257D4D41BE46BF7B5300937F546833225
SHA-256:	68627275BCBDAD4E556CB007DCEC75A4D0E3FDB5DB3E28167279854E259E0106
SHA-512:	D5B63246CC1C6B3AD077977CDEB73BAE6C5F9CE8C86EE5058EE25B0C2536F6EE9CAAE247B94E9B64C1C5FAA3B17B83DE4703269D2FF37A2404FD5B8710418E22
Malicious:	false
Reputation:	unknown
Preview:	0..2...0......H..............0...0......H..............0...0......H............0...0....H.......0.....2..N............;....+..I.g..x@4.?..o..Cu.3.E.=.AScb...V...o= U$..b.].e...S...Q.U..f .....D...G.$.....\.rU..).....8.;....f}._..N..b..;.......c3S.....W.2......~;..z.~^;..g'..%..K>.M\P.9.s..;...#.....p..r#.........fm..C....Q.....r.XGj.@b.....2].m...j...dh.'...........v.:..).'.@.k...!\|.Q.> ..S....@...%...!.X."....J....\|"...%....FE<.......?.N.....).....O.Ky(9J9cIo.}...5A....Q.Sj...\..d..N..r\.f..Z.6/z..P..I..\N@_D.]..<M.NQ.B9...-..X..zO..BIa.q.U..u..M........"!N.Z?...E.Y&f.c.y....p....B...ln..........D...1#.....{L.1.7..... ..k3......y..M....;.w[..A..s&..kB...x..0h..%.YO.Y..y..6.kSE.b.d.dx4DG.M9....c.....Ir.W.KB............/........F.o....F.'m.&:..[.....-...$.......\.l..W..:.z.h..EzT.)..hy&.,.....1t.\...&...j."..N.H7.ew..&......42.sY@....?.....].}.v.,.\..N.6.SHs2.#>wY5O..x9..h..G..O......Q.yi..*...M?.T.gq....u.G.y..n.._.<^...#....:Z.8.e

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\README.md Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	357
Entropy (8bit):	4.858748073407714
Encrypted:	false
SSDEEP:
MD5:	0341E90E5B5AE36F6399D9F43E579479
SHA1:	4C7FF562E6BDBFA4830B1F54A7E3CE8E3A1B3E04
SHA-256:	E11569E52B0AD3EB2352FD792DA2C61796A09355497E1B2DF64333803926439C
SHA-512:	0B5779DBC4FDB1E636F7129611F8E608AD7A4250D69DB60B9AA7E2453E090699A1F748BD571B916E794582614BF118D949A1A7B852535B5BEB71A7E90A510451
Malicious:	false
Reputation:	unknown
Preview:	## Quick and dirty readme..To run the veriskope electron app from vanila Veriskope src:..1. cd into GTLAdmin or GTLVisitor.2. npm install (I successfully built from npm 7.0.10).3. npm start..Note that inside main.js, you'll find..```javascript.mainWindow.loadURL('https://aikencountysc.gtlvisitme.com').```..Set that to preferred testing target and restart.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\entitlements.plist Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	917
Entropy (8bit):	4.837512089878404
Encrypted:	false
SSDEEP:
MD5:	46EE85AA4F35FA7EE03A82918A8DF014
SHA1:	605C7ECDB3CD9B82CBBC67DC8FDACD350D619A19
SHA-256:	7844F89A62925880E85044CFB824906B87F9350861DA126CF9E8C7A6A0DC32C5
SHA-512:	BCAC20543EA1761E31381A81BFEAE0275C57BCCB779B1A1529B5360B426340D8CC9CF47BA74DE1F2FB6DDCA7AAA6A3170140ABBF1D5C67B3607A7D0B5397D300
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">. <dict>. <key>com.apple.security.cs.allow-jit</key>. <true/>. <key>com.apple.security.cs.allow-unsigned-executable-memory</key>. <true/>. <key>com.apple.security.cs.allow-dyld-environment-variables</key>. <true/>. <key>com.apple.security.cs.disable-library-validation</key>. <true/>. <key>com.apple.security.cs.disable-executable-page-protection</key>. <true/>. <key>com.apple.security.files.user-selected.read-write</key>. <true/>. <key>com.apple.security.files.user-selected.read-only</key>. <true/>. <key>com.apple.security.device.camera</key>. <true/>. <key>com.apple.security.device.microphone</key>. <true/>. <key>com.apple.security.device.audio-input</key>. <true/>. </dict>.</plist>.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\forge.config.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1490
Entropy (8bit):	4.769555186208311
Encrypted:	false
SSDEEP:
MD5:	1705930D68717013F6401422A062D5E4
SHA1:	97D72E137E399E2473D35F23E1A486C28FCF44B6
SHA-256:	5DD9A721AE5E3C81611B56B0AC7DF93D3631BEA4F69E97C51E01A5B9EA085C9A
SHA-512:	2AB634FD0C29AB7352AC75F26E6BC9C4C6FBE5DACF0F69CA7F0590C88C97C039212C8996CA307E29C4DAC620E616A6CE13EAC8625F9B5C71D3D27A5C607D754D
Malicious:	false
Reputation:	unknown
Preview:	module.exports = {. packagerConfig: {. appBundleId: "net.gtl.visbridge",. icon: "icon",. osxSign: {. identity: "FRS5ZQHWKA",. "hardened-runtime": true,. entitlements: "entitlements.plist",. "entitlements-inherit": "entitlements.plist". },. osxNotarize: {. appleId: "erik.petersen@gtl.net",. appleIdPassword: "mkxl-flpb-kszu-icfz". },. protocols: [. {. name: "VisBridge Handler",. schemes: [. "gtl-visbridge". ]. }. ]. },. makers: [. {. name: "@electron-forge/maker-dmg",. config: {. format: "ULFO". }. },. {. name: "@electron-forge/maker-squirrel",. config: {. certificateFile: './5835243bf2fd8a85-SHA2.pfx',. certificatePassword: 'VUTfNLll7E0lFg627'. }. }. ],.. hooks: {. prePackage: async (forgeConfig, two) => {. if (process.platform == "darwin") {. forgeConfig.packagerConfig.ignore = "^pepflashplayer.dll";. }..

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\icon.icns Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	Mac OS X icon, 48389 bytes, "ic09" type
Category:	dropped
Size (bytes):	48389
Entropy (8bit):	7.993508605037426
Encrypted:	true
SSDEEP:
MD5:	A5ADA738AE10173ABE4638C90CB539AB
SHA1:	E8E7E7857263A1FE38CA6D8B795DB991B9AB4B77
SHA-256:	05FA8298A003B825A7304BB789B5ADCE6129E5755A853AF3CE016562A5C3963C
SHA-512:	DB772A79314DD4FBB70A60294F88D96B428E65F7FF6DB4BBC02A0471EA8BD39853C4FF4E16C7FD4CAB552D6EEFE98C1ECACA8C0919056F38C889C76EF624EF6A
Malicious:	false
Reputation:	unknown
Preview:	icns....ic09........jP ........ftypjp2 ....jp2 ...Ojp2h....ihdr..................colr.........."cdef..............................jp2c.O.Q.2.................................................R.............\..@@HHPHHPHHPHHPHHP.d.%..Created by OpenJPEG version 2.1.2...............}..PT....6...\|....(.D......Q..a=.a...7p..W...-<\|..-....._..l+..]..%a..$7..i.~.\...Fx.9J04~5.W!.\........L.M.N.&.\|..:$....C..Y.e.....<......#B..C...q%.}>.PT....6..$\.....%...^..~..^Z.l.p.O..2X0..B..1....\..-....ol.l.... ...{. ..M..LF.].....X@.......7.C)(z..b.{my!'J..La... ..m.oq...9j....1.y..e...cA<.}L.PT....6..$\.I.....mV@.fA....x'....w"V5Y.P..F...7..r...h......{.>.K..B....O..2wR"."......\|PV...k...3.._.m...r.z..A...F..].Q2!..+l.......-..,tG.2.b.[?.P....7.}P.}n.PT....3.[AY..I."O.:/.%..6....6......s...f....B........{e.cr...<'.J.m.E...Z..dA>#mk........@...K.),x".[k.j.+..w..E..n...F.......(.2.......4....$..E..Lt.1....S.M...>....z}.1...e...5,It......n..3.P~.Umo.}....0..Z.w.qj.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\icon.ico Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	MS Windows icon resource - 9 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	168463
Entropy (8bit):	2.288360816313362
Encrypted:	false
SSDEEP:
MD5:	57A7140BA38C0E5D92D56029DD9023F4
SHA1:	8FD5B29D70F44CE37E18ED4217258F3B22115E6E
SHA-256:	2FBD08F5E3FF8F25B6F69A184E6CFD55E02A92A36CB1E069F9DFC8D99FD67B13
SHA-512:	016DDD0FA2C2F274B3D13A20122DB411B26662E87AFF408C6C25EB08EBE73801890DB5C87B65CFAEA8B082775FA53B0B2769E8388EC74D3E667218CDF6ADEAA8
Malicious:	false
Reputation:	unknown
Preview:	............ .h............. ......... .... .........00.... ..%......@@.... .(B...D..HH.... ..T......``.... ............... .(....p........ .....Vx..(....... ..... ...........................................................................................................................................................................................................................................................................................................................................................z...z...u....(........b=&K]5.Q]5..]5..]5.>]5..]5.A]5.H]5.D]5....zp..z............OfC..]6..]5..]5..]5.d]5..]5.c]5..]5..]5..]5.=..y....D...L...(.jSg]4..]5.u]5..]5..]5.l]5..]5.f]5..]5.Z]5..]5....~;..~...~/...7.~vs]5..]5..]5..]5..]5..]5..]5..]5..]5.G]5.............>..........\|_nJ..\4..]5..]5..]5..]5..]5..]5..]5.:]5.........-...U...?......y...b.\4..]5..]5..]5..]5..]5..]5..]5..]5................................................................................................................

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\index.html Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	699
Entropy (8bit):	4.954730289156135
Encrypted:	false
SSDEEP:
MD5:	CA7A4835C7FB360787B5F908B9C0816C
SHA1:	ECB74124EA1E589452408F13E623B5001738205B
SHA-256:	ADCC7C227AF5226E1586066A4F6919A7D718F1036C2F409DB2D19B9F10AC6F80
SHA-512:	D65BC7E803095BBC42770AA7F26083971954E0A94B632E755443080634C6C4AAF8C2FC9DDE468838CD1CCCFE8DBDF8C5CB1B4E5BB01027384EA618459F227056
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html>.. <head>.. <meta charset="UTF-8">.. https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP -->.. <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'">.. <meta http-equiv="X-Content-Security-Policy" content="default-src 'self'; script-src 'self'">.. <title>Hello World!</title>.. </head>.. <body>.. <h1>Hello</h1>.. We are using Node.js <span id="node-version"></span>,.. Chromium <span id="chrome-version"></span>,.. and Electron <span id="electron-version"></span>..... You can also require other files to run in this process -->.. <script src="./renderer.js"></script>.. </body>..</html>..

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\main.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4211
Entropy (8bit):	4.9385264480732465
Encrypted:	false
SSDEEP:
MD5:	8205A06493C659D23D1AECFE4742E1C8
SHA1:	A40B99728DEC00C1C45DC9F5009C714A2E7D0EA2
SHA-256:	3E6D8BD0A353544D8EF8545A22B5D0DF884D8D563AB13BF20596E7B60FFF98B1
SHA-512:	EA0E3A4036D5DD527178DB951388384AF47A28D105E289014A25F5CE42D7668C128A3A42B03DD326EAC3C483362A097DDBE60B04F2A58D776B3144DFCBD27BEE
Malicious:	false
Reputation:	unknown
Preview:	// Modules to control application life and create native browser window.const {app, BrowserWindow, systemPreferences, dialog} = require('electron').const path = require('path').const protocol = app.protocol..if(require('electron-squirrel-startup')) return;..// VisMgr Prod:.let visBridgeVersion = "1.0.4";.let baseUrl = "https://www.gtlvisitme.com/app/facility_selector?audience=FnFApp&visbridgeversion=" + visBridgeVersion;.let httpProtocol = "gtl-visbridge";..// VisMgr QA:.// let baseUrl = "https://renwvtest26-tenant01.renovosoftware.com/VisitorVisitation/app/facility_selector?audience=officerApp&visbridgeversion=" + visBridgeVersion;..// tBridge Prod:.// let baseUrl = 'https://visit.telmate.com';.// let httpProtocol = "gtl-tbridge";..// tBridge QA:.// let baseUrl = 'https://visit-qa.telmate.com';.// let httpProtocol = "gtl-tbridge-qa";..let mainWindow;..function createWindow() {. // Create the browser window.. mainWindow = new BrowserWindow({. width: 1000,. height: 800,. webP

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\.package-lock.json Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	211596
Entropy (8bit):	5.214563629054663
Encrypted:	false
SSDEEP:
MD5:	F1BF0F8D5F5576B921510319BDF1481D
SHA1:	CE43BC3CFACFF650CF22A8916119726EA0A5F1E1
SHA-256:	5D4F74385850DF8D8846DDE5458A218936E453EBD13A62FEB689E145ADB88473
SHA-512:	BCEA49F74AC5A41FCDA66F846157562F69FB0C1DACA5E854DFB51FCED56ABEEB5A790B91758E179C39B5B8CE18CEC22BC9F484F9BCF68FD3F065461154DB99A7
Malicious:	false
Reputation:	unknown
Preview:	{.. "name": "VisBridge",.. "version": "1.0.3",.. "lockfileVersion": 2,.. "requires": true,.. "packages": {.. "node_modules/@electron-forge/async-ora": {.. "version": "6.0.0-beta.54",.. "resolved": "https://registry.npmjs.org/@electron-forge/async-ora/-/async-ora-6.0.0-beta.54.tgz",.. "integrity": "sha512-OCoHds0BIXaB54HgKw6pjlHC1cnaTcfJfVVkPSJl1GLC3VShZ5bETJfsitwbiP2kbfKLUQFayW27sqbwnwQR2w==",.. "dev": true,.. "dependencies": {.. "colors": "^1.4.0",.. "debug": "^4.1.0",.. "log-symbols": "^4.0.0",.. "ora": "^5.0.0",.. "pretty-ms": "^7.0.0".. },.. "engines": {.. "node": ">= 10.0.0".. }.. },.. "node_modules/@electron-forge/cli": {.. "version": "6.0.0-beta.54",.. "resolved": "https://registry.npmjs.org/@electron-forge/cli/-/cli-6.0.0-beta.54.tgz",.. "integrity": "sha512-+Ui1BI8c5CnBawH2OEySa5QR8DzrFd/I9FHlClvrTsIDfsBAeMSv9NTbSNcmo9Af5kI+aNsLQa8tp1vD8DNrng==",.. "dev": true,..

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\.eslintrc Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.028445159431229
Encrypted:	false
SSDEEP:
MD5:	FEE4C819F56872F8BF4D0EB00DD6EA24
SHA1:	AC230013846FEE33170DA58EC1A21609E7895064
SHA-256:	7BA7F8BD99CF2DB751EFD7937B0D5081D7E93818C073D9EEF79B1A1938FD8B1B
SHA-512:	0E263527BBDF4DB9F733C3FD1286D57F76073F2BC51C7EE021FA65B6BD6A9C7BE8C8F80EBB3B8342248AA6B26D9C84F2187FD8808BF210ECEA43FE5030895DA6
Malicious:	false
Reputation:	unknown
Preview:	{. "extends": "mongodb-js/node".}.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\.jsfmtrc Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5492
Entropy (8bit):	4.487885919809553
Encrypted:	false
SSDEEP:
MD5:	1BD48599514708649C236D3551270FD8
SHA1:	84170E4282E3FB35C446516F989532720BC315C8
SHA-256:	CEAB48D6AD3DA427A1C7A1D50889986D3F07AE6E28103DA36D0BAE7354CC0A81
SHA-512:	0D54C7FBE7F51C54FA3446C3856B53BB35695B1BE8DFC96E8C89F7EEBA3842D0AAC99F220BD823445DC6C093D7A35ECEEFF42B75AD3DD5F1A3953ED8C58647F5
Malicious:	false
Reputation:	unknown
Preview:	{. "preset": "default",. "plugins": [. "esformatter-quotes",. "esformatter-semicolons",. "esformatter-braces". ],. "quotes": {. "type": "single",. "avoidEscape": false. },. "indent": {. "value": " ". },. "whiteSpace" : {. "value" : " ",. "removeTrailing" : 1,.. "before" : {. "ArrayExpressionOpening" : 0,. "ArrayExpressionClosing" : 0,. "ArrayExpressionComma" : 0,. "ArgumentComma" : 0,. "ArgumentList" : 0,. "ArgumentListArrayExpression" : 0,. "ArgumentListFunctionExpression" : 0,. "ArgumentListObjectExpression" : 0,. "AssignmentOperator" : 1,. "BinaryExpression": 0,. "BinaryExpressionOperator" : 1,. "BlockComment" : 1,. "CallExpression" : -1,. "CatchParameterList" : 0,. "CatchOpeningBrace" : 1,. "CatchClosingBrace" : 1,. "CatchKeyword" : 1,. "CommaOperator" : 0,. "ConditionalExpressionConsequent" : 1,. "ConditionalExp

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\.npmignore Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.9898980954642878
Encrypted:	false
SSDEEP:
MD5:	E45F4B42AD3A220D7CBF46565C488717
SHA1:	E9B8F5B806DBFD2854EFAA441208BE6C53A611F7
SHA-256:	2F9AEBD7A15D0A9E62D69BFF1C888BB93EC5EAB506A9DB272DE622DEFDA4735C
SHA-512:	E3AE799B24C338A42C26F2B101FFEF9A52BAAA38FAB1B32B6A9CBBD5DC55AD97C129ECCD8BAF9B9EE1978769FC5E15C065AD88A6BEAB6AFA4DC06E8F7BD24A21
Malicious:	false
Reputation:	unknown
Preview:	node_modules/.*.log..DS_Store.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\.travis.yml Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.284121485442542
Encrypted:	false
SSDEEP:
MD5:	03892AC59023194511827ECB60BF8A55
SHA1:	BA4E43C90EAE79B101B49C849DE0D074D2EE67F6
SHA-256:	08EB5ECFF1BDCE19A2908DF9D60A1BF918C58130C9D3176415D0B76403F174D9
SHA-512:	D70449F212967A2DD57202C13021AE1482AC0395CF6C9864D609EC7E153607D64FA91FE4AEB683F890BE9F577B551A53303C75F3ECB5BB7EBEC28B97639A9824
Malicious:	false
Reputation:	unknown
Preview:	sudo: false.language: node_js.node_js:. - 5.script: npm run ci.cache:. directories:. - node_modules.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\LICENSE Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10255
Entropy (8bit):	4.635911532416969
Encrypted:	false
SSDEEP:
MD5:	D92E60EE98664C54F68AA515A6169708
SHA1:	F0B513A735CC88CC1F37C5EE0CAEC2A9E154BD86
SHA-256:	9CF5DE169B595CDAE317551EF69A794B59FA3D1E151DB4190D337FE08D13D5F8
SHA-512:	477FB6A7B187FF3D043B413022C3AAA7EF83FB8EDF026F25EFC3C6F032AFDB4B2EE0C2028E4C70A0769D1F1CBA78D10EEB284B2A70EBF4C171540A1D7AAC6BBD
Malicious:	false
Reputation:	unknown
Preview:	Apache License.Version 2.0, January 2004.http://www.apache.org/licenses/..TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION..1. Definitions..."License" shall mean the terms and conditions for use, reproduction,.and distribution as defined by Sections 1 through 9 of this document..."Licensor" shall mean the copyright owner or entity authorized by.the copyright owner that is granting the License..."Legal Entity" shall mean the union of the acting entity and all.other entities that control, are controlled by, or are under common.control with that entity. For the purposes of this definition,."control" means (i) the power, direct or indirect, to cause the.direction or management of such entity, whether by contract or.otherwise, or (ii) ownership of fifty percent (50%) or more of the.outstanding shares, or (iii) beneficial ownership of such entity..."You" (or "Your") shall mean an individual or Legal Entity.exercising permissions granted by this License..."Source" form shall mean

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\README.md Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	832
Entropy (8bit):	4.9551933727996085
Encrypted:	false
SSDEEP:
MD5:	8E386943339B0E9CC652816ECFE6F710
SHA1:	8E3C7EADCA3BFE25CA68BFE15A0CCC2D8C9471D0
SHA-256:	913A5BC29AC3A8C1678FA9FDA57A65F85C6F5907555A3A36C77CE4EB4199D8A4
SHA-512:	B507A050C92463A6926042BE8E311BFE5EE19FC0F2F8A5AA6FE894E0ACF6CA5C630289865ADFFDB148928B61C24C740E60C79C89C0AD8E815151D0EDE80B2A62
Malicious:	false
Reputation:	unknown
Preview:	# electron-squirrel-startup..> Default [Squirrel.Windows][squirrel] event handler for your [Electron][electron] apps...## Installation..```.npm i electron-squirrel-startup.```..## Usage..To handle the most common commands, such as managing desktop shortcuts, just.add the following to the top of your `main.js` and you're good to go:..```js.if(require('electron-squirrel-startup')) return;.```..## Read More..### [Handling Squirrel Events][squirrel-events].### [Squirrel.Windows Commands][squirrel-commands]..## License..Apache 2.0..[squirrel]: https://github.com/Squirrel/Squirrel.Windows.[electron]: https://github.com/atom/electron.[squirrel-commands]: https://github.com/Squirrel/Squirrel.Windows/blob/master/src/Update/Program.cs#L98.[squirrel-events]: https://github.com/atom/grunt-electron-installer#handling-squirrel-events.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\appveyor.yml Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	4.5412925036196805
Encrypted:	false
SSDEEP:
MD5:	0029CC38C7891B598D622564B2A9B4B5
SHA1:	8E98BA29F74652C95320E02F243471D489CA1737
SHA-256:	E34046D32EDF13334E8E410B6B2C504461EF5E562FDA19A1068CA5EA7D587AE4
SHA-512:	CBA70098305A4B4454F3622048ADD11D1E49BCF200F7197892CE72C97603A90172E45765E9489B117C2B8BB1714BBC64999D94EAB194AAA8F81AF7D07EFFEA4D
Malicious:	false
Reputation:	unknown
Preview:	init:. - git config --global core.autocrlf input..environment:. matrix:. - nodejs_version: 0.12..install:. - ps: Update-NodeJsInstallation (Get-NodeJsLatestBuild $env:nodejs_version). - npm install..build: off..test_script:. - node --version. - npm --version. - ps: npm run ci.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\index.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1027
Entropy (8bit):	4.782176311889541
Encrypted:	false
SSDEEP:
MD5:	82B9483BCFFB68E349758C54D4E4B2B2
SHA1:	BC68E51EEEA227C01C04A51434C4730158465969
SHA-256:	800EFEE091FC95F5809A01DF5C9B06A3BD577FA935C5F9FC6A2D2CC8A795F401
SHA-512:	0020D6E3370910D991E4B0D6A39C6B37395568303E6EAD12BF3269237F487E83CD44EBE21AED0D8DAC91ACCC8B15F1F83F1F888C4AC421223061FD5AAF5B2DB1
Malicious:	false
Reputation:	unknown
Preview:	var path = require('path');.var spawn = require('child_process').spawn;.var debug = require('debug')('electron-squirrel-startup');.var app = require('electron').app;..var run = function(args, done) {. var updateExe = path.resolve(path.dirname(process.execPath), '..', 'Update.exe');. debug('Spawning `%s` with args `%s`', updateExe, args);. spawn(updateExe, args, {. detached: true. }).on('close', done);.};..var check = function() {. if (process.platform === 'win32') {. var cmd = process.argv[1];. debug('processing squirrel command `%s`', cmd);. var target = path.basename(process.execPath);.. if (cmd === '--squirrel-install' \|\| cmd === '--squirrel-updated') {. run(['--createShortcut=' + target + ''], app.quit);. return true;. }. if (cmd === '--squirrel-uninstall') {. run(['--removeShortcut=' + target + ''], app.quit);. return true;. }. if (cmd === '--squirrel-obsolete') {. app.quit();. return true;. }. }. return false;.};.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\.coveralls.yml Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.958344564752663
Encrypted:	false
SSDEEP:
MD5:	55352D85883681DF5F0FA66D3F32A872
SHA1:	90709E4FB4CE17729974B3A140CCBF330519835C
SHA-256:	64E6B64F19837A76C30865579AABDDE1A825729AE0204BA73BA6DE77296CE18E
SHA-512:	BD3F23A4D44A5DF32AE36277D55BF3335D4E8A2954B2AE2DB3167996058B8C6D1E74C2DD9DD2C934BC1D70C15C026FC075A53D47E7B856750047FB86F6B22F58
Malicious:	false
Reputation:	unknown
Preview:	repo_token: SIAeZjKYlHK74rbcFvNHMUzjRiMpflxve.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\.eslintrc Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.301685598072847
Encrypted:	false
SSDEEP:
MD5:	F69AF9893C473D8E925169156A42F70C
SHA1:	8D154AEDDF66A7BCBD433E3C619F76BB0D920AE2
SHA-256:	7B7D5A5736DDDAE0E7CF1C06CDF41DDD9F98E73DB8F57A18FE4C9BD0F52F9AA3
SHA-512:	4239496B31071B799E30DCC18A05E6E95279799418A97DD57141A4D0F07EE0DDB057E09CB13C30C400202474B61E71175495B3CC411747ADE097D12F4EE87DD0
Malicious:	false
Reputation:	unknown
Preview:	{. "env": {. "browser": true,. "node": true. },. "rules": {. "no-console": 0,. "no-empty": [1, { "allowEmptyCatch": true }]. },. "extends": "eslint:recommended".}.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\.npmignore Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.255848091329463
Encrypted:	false
SSDEEP:
MD5:	B0205B7904BEF0AD0B403FBCF4F57434
SHA1:	90FEF7CC1058BD0F85B0959C4FCD49230A29593E
SHA-256:	F4580152A6F48954B44CB2A0A002FA500467663DB5A6DC8E796B52533DC04EC1
SHA-512:	FD7F6D36580B9F9D94247FB4EC398C7BFE7715399D11A1D6FA1EFC51E95405EE8F5E6559C5861B0D032AB425F0DE24C7E84BB4C03594E715FA21CD47461A69B4
Malicious:	false
Reputation:	unknown
Preview:	support.test.examples.example.*.sock.dist.yarn.lock.coverage.bower.json.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\.travis.yml Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	140
Entropy (8bit):	4.230134094195066
Encrypted:	false
SSDEEP:
MD5:	75C6CBB25B2A5720C8663637A2678879
SHA1:	E87A69A064F6A95B166333D46B919AFBC5487F59
SHA-256:	839E44EE0A96A3E302DC6472800B51822982B77D08F19200AB2CC70534781FD8
SHA-512:	9FEE1C0DF8C2098D418BA0816E47EEFE46063E5DC62D5B9B9B2DC951968627F4E5B53B7C27F42FB6C8CAAC0AF10E3BD4C32526913C3B467E6059237601A77DE0
Malicious:	false
Reputation:	unknown
Preview:	.language: node_js.node_js:. - "6". - "5". - "4"..install:. - make node_modules..script:. - make lint. - make test. - make coveralls.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\CHANGELOG.md Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11707
Entropy (8bit):	5.135546321275976
Encrypted:	false
SSDEEP:
MD5:	504A70C7EB9EBA0C4B26965CF4D252C6
SHA1:	C35E6A85B4A8732EC8AF63BEEA964483E1B2DD94
SHA-256:	D8C1B0717964E189010B13521379C3B970EECC889CB8B788AC21D8DD85247165
SHA-512:	CB9836AF90C63DEEAF5C2DD5085685B3213B3579337D69F9B44DFB5C61C6BFFA5A940C4D9E9B8BB8DF4A845C0F7008077FA35598B27FE45079FB921FE8528E50
Malicious:	false
Reputation:	unknown
Preview:	.2.6.9 / 2017-09-22.==================.. * remove ReDoS regexp in %o formatter (#504)..2.6.8 / 2017-05-18.==================.. * Fix: Check for undefined on browser globals (#462, @marbemac)..2.6.7 / 2017-05-16.==================.. * Fix: Update ms to 2.0.0 to fix regular expression denial of service vulnerability (#458, @hubdotcom). * Fix: Inline extend function in node implementation (#452, @dougwilson). * Docs: Fix typo (#455, @msasad)..2.6.5 / 2017-04-27.==================. . * Fix: null reference check on window.documentElement.style.WebkitAppearance (#447, @thebigredgeek). * Misc: clean up browser reference checks (#447, @thebigredgeek). * Misc: add npm-debug.log to .gitignore (@thebigredgeek)...2.6.4 / 2017-04-20.==================.. * Fix: bug that would occure if process.env.DEBUG is a non-string value. (#444, @LucianBuzzo). * Chore: ignore bower.json in npm installations. (#437, @joaovieira). * Misc: update "ms" to v0.7.3 (@tootallnate)..2.6.3 / 2017-03-13.=======

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\LICENSE Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.12256218715534
Encrypted:	false
SSDEEP:
MD5:	DDD815A475E7338B0BE7A14D8EE35A99
SHA1:	D16A2786962571280A11CAE01D5E59AEB1351C9A
SHA-256:	98C970DE440DCFC77471610AEC2377C9D9B0DB2B3BE6D1ADD524A586E1D7F422
SHA-512:	47B612EF4E93F1AF62891E295E9FBAC05E02CF1726F56C36FAD5314376E28CBCAF7C8355527BC0BDA54C26CBE097BC8CA5CB4F79AA9E3AB6F1D875DCA41D4AAC
Malicious:	false
Reputation:	unknown
Preview:	(The MIT License)..Copyright (c) 2014 TJ Holowaychuk <tj@vision-media.ca>..Permission is hereby granted, free of charge, to any person obtaining a copy of this software .and associated documentation files (the 'Software'), to deal in the Software without restriction, .including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, .and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial .portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT .LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. .IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, .WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWIS

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\Makefile Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.556812469512553
Encrypted:	false
SSDEEP:
MD5:	F8739CAB4AE015EE84820716A8AC193A
SHA1:	89EB5A7B8385734EF7FF4F910D4605CDE0BC12FD
SHA-256:	F6466507E02C62F14E477AF08E4A13EC883152B54D87FEEFFB8F0D6DE6E9013B
SHA-512:	EF875B744303169B5600CE5C42A0791A38BF933983F5011BA2EA9560AC5449E6FE9D4AE706EFC970B40096B9533A425FFC53265353EAD256BE44606790688BF1
Malicious:	false
Reputation:	unknown
Preview:	# get Makefile directory name: http://stackoverflow.com/a/5982798/376773.THIS_MAKEFILE_PATH:=$(word $(words $(MAKEFILE_LIST)),$(MAKEFILE_LIST)).THIS_DIR:=$(shell cd $(dir $(THIS_MAKEFILE_PATH));pwd)..# BIN directory.BIN := $(THIS_DIR)/node_modules/.bin..# Path.PATH := node_modules/.bin:$(PATH).SHELL := /bin/bash..# applications.NODE ?= $(shell which node).YARN ?= $(shell which yarn).PKG ?= $(if $(YARN),$(YARN),$(NODE) $(shell which npm)).BROWSERIFY ?= $(NODE) $(BIN)/browserify...FORCE:..install: node_modules..node_modules: package.json..@NODE_ENV= $(PKG) install..@touch node_modules..lint: .FORCE..eslint browser.js debug.js index.js node.js..test-node: .FORCE..istanbul cover node_modules/mocha/bin/_mocha -- test/**.js..test-browser: .FORCE..mkdir -p dist...@$(BROWSERIFY) \...--standalone debug \.... > dist/debug.js...karma start --single-run..rimraf dist..test: .FORCE..concurrently \..."make test-node" \..."make test-browser"..coveralls:..cat ./coverage/lcov.info \| ./node_modules/cover

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\README.md Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	17918
Entropy (8bit):	5.215109378560089
Encrypted:	false
SSDEEP:
MD5:	03694893D682191B3C893701BA6F4A55
SHA1:	38096A9C10830714695A97A8501B817EB0A7534E
SHA-256:	CDA3DBD285A2B65894758565A565E7BC2E7C3696225AF7B5BD01454240DF0AEA
SHA-512:	3B80EA8A912EC4DDF1A1E2FC3F3EBD8F4BC6F591F9B2732694CB5627C549D7911C1A6EB82AB68AC025E13E090B3E39B8B4AE66A9159F45696B6343CE76213F54
Malicious:	false
Reputation:	unknown
Preview:	# debug.[![Build Status](https://travis-ci.org/visionmedia/debug.svg?branch=master)](https://travis-ci.org/visionmedia/debug) [![Coverage Status](https://coveralls.io/repos/github/visionmedia/debug/badge.svg?branch=master)](https://coveralls.io/github/visionmedia/debug?branch=master) [![Slack](https://visionmedia-community-slackin.now.sh/badge.svg)](https://visionmedia-community-slackin.now.sh/) [![OpenCollective](https://opencollective.com/debug/backers/badge.svg)](#backers) .[![OpenCollective](https://opencollective.com/debug/sponsors/badge.svg)](#sponsors)....A tiny node.js debugging utility modelled after node core's debugging technique...Discussion around the V3 API is under way [here](https://github.com/visionmedia/debug/issues/370)..## Installation..```bash.$ npm install debug.```..## Usage..`debug` exposes a function; simply pass this function the name of your module, and it will return a decorated version of `console.error` for you to pass debug statements to. This will

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\component.json Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.465851094571166
Encrypted:	false
SSDEEP:
MD5:	510AF4D67A35446E6DCCEA1429399C3A
SHA1:	4963889B7905ABD5A8955B8D27C3079E2D449564
SHA-256:	2E5AB9AE90F41699E00D00FCA16765024F437300A0568C2208669CC281BA7656
SHA-512:	BB8D1E0E4C99A82D32FB40DAA9A79E2ABF3A3F495B3DC9AFA883021110B3CA9EB93E052D71E98D6494722DF947EC280D66F4BCA36BB0AE975F05D710E8C47415
Malicious:	false
Reputation:	unknown
Preview:	{. "name": "debug",. "repo": "visionmedia/debug",. "description": "small debugging utility",. "version": "2.6.9",. "keywords": [. "debug",. "log",. "debugger". ],. "main": "src/browser.js",. "scripts": [. "src/browser.js",. "src/debug.js". ],. "dependencies": {. "rauchg/ms.js": "0.7.1". }.}.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\karma.conf.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	4.788611478595854
Encrypted:	false
SSDEEP:
MD5:	06F3BABBDC43C6C4DD1493B6C1AF32E2
SHA1:	93FEF7CF3ED6F04D2CFC3CD0B8D5D972D35CFD29
SHA-256:	2430869ADB61A5E24A3612110A9B49A948E6DB43AB7E947C003A9C19C478E609
SHA-512:	AD65132ED6F675F6F318FEFA36F4E6C23F3FF4DC47D02575F6D5BEF7B062A2E90AEA1A43DD5327C2565BE3D834C969FF2AE3EFDB2ADD4A958882A6F056F659EA
Malicious:	false
Reputation:	unknown
Preview:	// Karma configuration.// Generated on Fri Dec 16 2016 13:09:51 GMT+0000 (UTC)..module.exports = function(config) {. config.set({.. // base path that will be used to resolve all patterns (eg. files, exclude). basePath: '',... // frameworks to use. // available frameworks: https://npmjs.org/browse/keyword/karma-adapter. frameworks: ['mocha', 'chai', 'sinon'],... // list of files / patterns to load in the browser. files: [. 'dist/debug.js',. 'test/*spec.js'. ],... // list of files to exclude. exclude: [. 'src/node.js'. ],... // preprocess matching files before serving them to the browser. // available preprocessors: https://npmjs.org/browse/keyword/karma-preprocessor. preprocessors: {. },.. // test results reporter to use. // possible values: 'dots', 'progress'. // available reporters: https://npmjs.org/browse/keyword/karma-reporter. reporters: ['progress'],... // web server port. port: 9876,... // enable /

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\node.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.362814895472354
Encrypted:	false
SSDEEP:
MD5:	79F3814F32362C1C6F9DBB8A1E3B01BF
SHA1:	AA7655EE80C9A485313675F9379C2F18D33EA061
SHA-256:	996B381F353555CB172EBB2802BB2A7323442FF67B7B530CC26834058D7F31A2
SHA-512:	61367EC2AFF9349E203A295FE1BC28FADDC6D80B556660F56EA49D6625D6228212FE82D7398114509A3B8D9AD4026429F0EBB849579C7481928F47F37C8632D5
Malicious:	false
Reputation:	unknown
Preview:	module.exports = require('./src/node');.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\package.json Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1138
Entropy (8bit):	4.7852828549554145
Encrypted:	false
SSDEEP:
MD5:	71A7656944FFE50CC27EBE02491AE49B
SHA1:	8EBF0F80660D982FC68F00F82855696157E74B10
SHA-256:	6C3D2C892DB282317913CE7C340DD2EDCCD326BCAFD18B644B8738144967D6EE
SHA-512:	5B0010B41304E212A22D2C89EFF65CE410B000C71C4AB8C7FDBA8F549BA0629FE27F37C142058B041FB889BC73E00959AD58F673866EE7D29724687DA3C3F320
Malicious:	false
Reputation:	unknown
Preview:	{. "name": "debug",. "version": "2.6.9",. "repository": {. "type": "git",. "url": "git://github.com/visionmedia/debug.git". },. "description": "small debugging utility",. "keywords": [. "debug",. "log",. "debugger". ],. "author": "TJ Holowaychuk <tj@vision-media.ca>",. "contributors": [. "Nathan Rajlich <nathan@tootallnate.net> (http://n8.io)",. "Andrew Rhyne <rhyneandrew@gmail.com>". ],. "license": "MIT",. "dependencies": {. "ms": "2.0.0". },. "devDependencies": {. "browserify": "9.0.3",. "chai": "^3.5.0",. "concurrently": "^3.1.0",. "coveralls": "^2.11.15",. "eslint": "^3.12.1",. "istanbul": "^0.4.5",. "karma": "^1.3.0",. "karma-chai": "^0.1.0",. "karma-mocha": "^1.3.0",. "karma-phantomjs-launcher": "^1.0.2",. "karma-sinon": "^1.0.5",. "mocha": "^3.2.0",. "mocha-lcov-reporter": "^1.2.0",. "rimraf": "^2.5.4",. "sinon": "^1.17.6",. "sinon-chai": "^2.8.0". },. "main": "./src/index.js",. "browser": "

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\browser.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4734
Entropy (8bit):	4.98143252477633
Encrypted:	false
SSDEEP:
MD5:	62CFEE6D6DD5FFEC5D3ED35073791AEC
SHA1:	C41ADC79487F377D3DFB397C531812FB9CC429A2
SHA-256:	0144AB6A52B9330C567DE11A5C3A4AEA35CDAC47A4C106482AA24AE8054CDC6F
SHA-512:	920AEA250D98E29E8005EF0185DF5E34BC426D321785DF07CBABACE60BDBCFC6C92E2FF0C9F226A54925D2C7D595035EFEABABC935C7F1A4C704E7A7EF641339
Malicious:	false
Reputation:	unknown
Preview:	/*. This is the web browser implementation of `debug()`.. . Expose `debug()` as the module.. /..exports = module.exports = require('./debug');.exports.log = log;.exports.formatArgs = formatArgs;.exports.save = save;.exports.load = load;.exports.useColors = useColors;.exports.storage = 'undefined' != typeof chrome. && 'undefined' != typeof chrome.storage. ? chrome.storage.local. : localstorage();../. Colors.. /..exports.colors = [. 'lightseagreen',. 'forestgreen',. 'goldenrod',. 'dodgerblue',. 'darkorchid',. 'crimson'.];../. Currently only WebKit-based Web Inspectors, Firefox >= v31,. * and the Firebug extension (any Firefox version) are known. * to support "%c" CSS customizations.. . TODO: add a `localStorage` variable to explicitly enable/disable colors. */..function useColors() {. // NB: In an Electron preload script, document will be defined but not fully. // initialized. Since we know we're in Chrome, we'll

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\debug.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4394
Entropy (8bit):	4.818652396947732
Encrypted:	false
SSDEEP:
MD5:	74BDCCF347345D27FE8A4AC3ADD99C60
SHA1:	A2B8A915C86FC750F56A7137860F19EC1182EE21
SHA-256:	D8D1C1D6C387AB67C3F28D78FD0B20B9BECD69442DB9D3EFE110CA464B509C8A
SHA-512:	C2D47EFEE2A4442BE6375D623F46B4C7EE9552C132B9229EB284BDD98629EDD02664167805B0AF9B3FAAA9B1906E9ED0C5E383396D4995CEF7051F9A450E1B99
Malicious:	false
Reputation:	unknown
Preview:	./*. This is the common logic for both the Node.js and web browser. * implementations of `debug()`.. . Expose `debug()` as the module.. /..exports = module.exports = createDebug.debug = createDebug['default'] = createDebug;.exports.coerce = coerce;.exports.disable = disable;.exports.enable = enable;.exports.enabled = enabled;.exports.humanize = require('ms');../. The currently active debug mode names, and names to skip.. /..exports.names = [];.exports.skips = [];../. Map of special "%n" handling functions, for the debug "format" argument.. . Valid key names are a single, lower or upper-case letter, i.e. "n" and "N".. /..exports.formatters = {};../. Previous log timestamp.. /..var prevTime;../. Select a color.. * @param {String} namespace. * @return {Number}. * @api private. */..function selectColor(namespace) {. var hash = 0, i;.. for (i in namespace) {. hash = ((hash << 5) - hash) + namespace.charCodeAt(i);. hash \|= 0; // Convert to 32bit integer.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\index.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	263
Entropy (8bit):	4.632071401695598
Encrypted:	false
SSDEEP:
MD5:	DD13897EA2EED92695BB7E4E744A9148
SHA1:	182314D32E789E4F9C29E3150AE392F1630F171C
SHA-256:	9A34FEDEB2D269C46ED94E6F13039EB0D16D866DD460EC66FA3ACD78122FA9FE
SHA-512:	0B53BC984178336AC516601E72D477D2BEEEF6936800DA17D3A79C153E0036F7428517EBD75D296729F65856C7E07749029F5AA192B2AC071EFC4D3E39750A32
Malicious:	false
Reputation:	unknown
Preview:	/*. Detect Electron renderer process, which is node, but we should. * treat as a browser.. */..if (typeof process !== 'undefined' && process.type === 'renderer') {. module.exports = require('./browser.js');.} else {. module.exports = require('./node.js');.}.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\inspector-log.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	373
Entropy (8bit):	4.732381821992279
Encrypted:	false
SSDEEP:
MD5:	B22697B673C7C3586F22AE0206258FDE
SHA1:	B2F2996B1F38B6CEC0B1746BE6CFE458F2585EAC
SHA-256:	949AE67EC1B655694F83DCE57D47D9D77234F9E7D698616932A90E69C7AFEE91
SHA-512:	4FFD89DBC519A1F6C2F56A1B26F1AAD445DF8D5096DA1453645DBB67DC58B17AE9143906357CA4AF60059740C3BA34F7233049652B805D1AFED3FD206CD55A0C
Malicious:	false
Reputation:	unknown
Preview:	module.exports = inspectorLog;..// black hole.const nullStream = new (require('stream').Writable)();.nullStream._write = () => {};../*. Outputs a `console.log()` to the Node.js Inspector console only.. */.function inspectorLog() {. const stdout = console._stdout;. console._stdout = nullStream;. console.log.apply(console, arguments);. console._stdout = stdout;.}.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\node.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6015
Entropy (8bit):	4.983354444087808
Encrypted:	false
SSDEEP:
MD5:	25807A97FBB1FCC42A013ABC7D7768C4
SHA1:	F24D52CBC9144B011DEF218234FF7B50E7DDCB19
SHA-256:	A3E83594A4CE88997E2E4FC66BC942B17B9D736290AD62560C7F09D6D0989AD0
SHA-512:	8D316B63700126D7C8965A886E9B35A332D3F7E68D28F2264D235C0AFAD28066F877F25821E1983DDDE5F2D5052716CC73338779B41B6F4D1B90AD33DC3E9F24
Malicious:	false
Reputation:	unknown
Preview:	/*. Module dependencies.. /..var tty = require('tty');.var util = require('util');../. This is the Node.js implementation of `debug()`.. . Expose `debug()` as the module.. /..exports = module.exports = require('./debug');.exports.init = init;.exports.log = log;.exports.formatArgs = formatArgs;.exports.save = save;.exports.load = load;.exports.useColors = useColors;../. Colors.. /..exports.colors = [6, 2, 3, 4, 5, 1];../. Build up the default `inspectOpts` object from the environment variables.. . $ DEBUG_COLORS=no DEBUG_DEPTH=10 DEBUG_SHOW_HIDDEN=enabled node script.js. */..exports.inspectOpts = Object.keys(process.env).filter(function (key) {. return /^debug_/i.test(key);.}).reduce(function (obj, key) {. // camel-case. var prop = key. .substring(6). .toLowerCase(). .replace(/_([a-z])/g, function (_, k) { return k.toUpperCase() });.. // coerce string value into JS value. var val = process.env[key];. if (/^(yes\|on\|true\|enabled)$/i.test(val)) val

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\ms\index.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2764
Entropy (8bit):	4.722254619992073
Encrypted:	false
SSDEEP:
MD5:	AE157C9A8E70902576C2D8A06DBCDE32
SHA1:	0D10EE921436FA5FF5988445CC67676219DFFFBE
SHA-256:	4BD92209CB9DACF3E3773E725ACB7AAEC43EA9E78540324E4D0F73E5CE9ADEF7
SHA-512:	4C2F31F1F2A297AB6C55A21D58A5C26CAD22C1ED1913E7A48605111D217257AE2D9F26EA889E8610E011BA9B9C487C91ECDB4CEA3437534FAF905E8FB89BA248
Malicious:	false
Reputation:	unknown
Preview:	/*. Helpers.. /..var s = 1000;.var m = s 60;.var h = m * 60;.var d = h * 24;.var y = d * 365.25;../*. Parse or format the given `val`.. . Options:. . - `long` verbose formatting [false]. . @param {String\|Number} val. * @param {Object} [options]. * @throws {Error} throw an error if val is not a non-empty string or a number. * @return {String\|Number}. * @api public. /..module.exports = function(val, options) {. options = options \|\| {};. var type = typeof val;. if (type === 'string' && val.length > 0) {. return parse(val);. } else if (type === 'number' && isNaN(val) === false) {. return options.long ? fmtLong(val) : fmtShort(val);. }. throw new Error(. 'val is not a non-empty string or a valid number. val=' +. JSON.stringify(val). );.};../. Parse the given `str` and return milliseconds.. . @param {String} str. * @return {Number}. * @api private. */..function parse(str) {. str = String(str);. if (str.length > 100) {. return;. }. var ma

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\ms\license.md Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.1041829250749355
Encrypted:	false
SSDEEP:
MD5:	FD56FD5F1860961DFA92D313167C37A6
SHA1:	884E84EBFDDAFD93B5BB814DF076D2EBD1757BA8
SHA-256:	6652830C2607C722B66F1B57DE15877AB8FC5DCA406CC5B335AFEB365D0F32C1
SHA-512:	2BEC1EFB4DC59FA436C38A1B45B3DBD54A368460BCBBB3D9791B65275B5DC3C71A4C54BE458F4C74761DCCB8897EFAAB46DF5A407723DA5C48F3DB02D555D5B9
Malicious:	false
Reputation:	unknown
Preview:	The MIT License (MIT)..Copyright (c) 2016 Zeit, Inc...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR I

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\ms\package.json Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	704
Entropy (8bit):	4.420367267663251
Encrypted:	false
SSDEEP:
MD5:	CBD55880A650B56C3D5ACDDBBDBEE9BC
SHA1:	4D354DA7ECE1C7D5689B8104F3B6F3DCBAC7790E
SHA-256:	30FBFAA3840B2F63978AD4BCD7ED8DC24D277B818E4755FE93EDA8CB1BC8B74C
SHA-512:	E329A6F6A38DD33BD60334A8DEC4A91AA6E7DAB28F0893240374AE6A303C12646399D821403E3B80EB51317D1808E6ABF30BD91B0BD99951F96815A22BA105C7
Malicious:	false
Reputation:	unknown
Preview:	{. "name": "ms",. "version": "2.0.0",. "description": "Tiny milisecond conversion utility",. "repository": "zeit/ms",. "main": "./index",. "files": [. "index.js". ],. "scripts": {. "precommit": "lint-staged",. "lint": "eslint lib/* bin/",. "test": "mocha tests.js". },. "eslintConfig": {. "extends": "eslint:recommended",. "env": {. "node": true,. "es6": true. }. },. "lint-staged": {. ".js": [. "npm run lint",. "prettier --single-quote --write",. "git add". ]. },. "license": "MIT",. "devDependencies": {. "eslint": "3.19.0",. "expect.js": "0.3.1",. "husky": "0.13.3",. "lint-staged": "3.4.1",. "mocha": "3.4.1". }.}.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\ms\readme.md Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	4.954772186039823
Encrypted:	false
SSDEEP:
MD5:	90E631C6AFCCDE3ED414D3D230734864
SHA1:	E875D9FA741FE44893C778974860F362724E35EC
SHA-256:	C9AC67FF103C01871B0FF09E2F094631991908C1FD0DC08BDB53287E5A760AE5
SHA-512:	BC98602BB2B67AE4FEFAC895CEF22F3C25B2E765D9074121700DC523365FEB252BA813684275F74B7FFCA4A8CBF34B68384AAE1A84BB76D09E55413741172005
Malicious:	false
Reputation:	unknown
Preview:	# ms..[![Build Status](https://travis-ci.org/zeit/ms.svg?branch=master)](https://travis-ci.org/zeit/ms).[![Slack Channel](http://zeit-slackin.now.sh/badge.svg)](https://zeit.chat/)..Use this package to easily convert various time formats to milliseconds...## Examples..```js.ms('2 days') // 172800000.ms('1d') // 86400000.ms('10h') // 36000000.ms('2.5 hrs') // 9000000.ms('2h') // 7200000.ms('1m') // 60000.ms('5s') // 5000.ms('1y') // 31557600000.ms('100') // 100.```..### Convert from milliseconds..```js.ms(60000) // "1m".ms(2 * 60000) // "2m".ms(ms('10 hours')) // "10h".```..### Time format written-out..```js.ms(60000, { long: true }) // "1 minute".ms(2 * 60000, { long: true }) // "2 minutes".ms(ms('10 hours'), { long: true }) // "10 hours".```..## Features..- Works both in [node](https://nodejs.org) and in the browser..- If a number is supplied to `ms`, a string with a unit is returned..- If a string that co

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\package.json Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.76103729380122
Encrypted:	false
SSDEEP:
MD5:	D09EF36E9C8134374337901B0F147A97
SHA1:	55EE334BD02C1B8305D533E0572BA399C38EB0A8
SHA-256:	17D9ACFE78D4456B6F9AA6DBB46722052224681B94AAFC5DFDC41CC0246B76FB
SHA-512:	473A0DA87617D9F165B58EE8FD6443D10E0281A73D923F327F2B2CAADC03E163AF4E75642A3CAB2A0C2C2D39C1A5B035580B46DD16944BE1E0E0268778ECCAB0
Malicious:	false
Reputation:	unknown
Preview:	{. "name": "electron-squirrel-startup",. "version": "1.0.0",. "description": "Default Squirrel.Windows event handler for your Electron apps.",. "author": "Lucas Hrabovsky <lucas@mongodb.com> (http://imlucas.com)",. "homepage": "http://github.com/mongodb-js/electron-squirrel-startup",. "license": "Apache-2.0",. "repository": {. "type": "git",. "url": "https://github.com/mongodb-js/electron-squirrel-startup.git". },. "scripts": {. "ci": "mocha",. "test": "mocha",. "check": "mongodb-js-precommit". },. "precommit": [. "check". ],. "dependencies": {. "debug": "^2.2.0". },. "devDependencies": {. "eslint-config-mongodb-js": "^0.1.4",. "mocha": "^2.2.5",. "mongodb-js-precommit": "^0.1.2",. "pre-commit": "^1.0.10". },. "dependency-check": {. "ignore": [. "app". ]. },. "keywords": [. "mongodb.js",. "electron",. "electron-installer",. "squirrel.windows". ].}.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\test\index.test.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	250
Entropy (8bit):	4.574941511855462
Encrypted:	false
SSDEEP:
MD5:	A7D81905E8B1EE15523969B674A19567
SHA1:	EA3BA6F377B4F3901DA977FE4532862A86B09D47
SHA-256:	4DF95088BF976361127297D3963C48670CE722169EC84E4C4B6841147BCD98DC
SHA-512:	5C1FF86D57EBBA0DD1DB539D4D06B1290F65BD9CAC77B675E65EF8BCD3EE15246F90C689323AC43289C0BE067A898FDAB89197DCA5D2111B13AFACC6097D99E5
Malicious:	false
Reputation:	unknown
Preview:	var assert = require('assert');.var startup = require('../');.var proxyquire = require('proxyquire');..describe('electron-squirrel-startup', function() {. it('should return false by default', function() {. assert.equal(startup, false);. });.});.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\package-lock.json Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	416733
Entropy (8bit):	5.211355386965018
Encrypted:	false
SSDEEP:
MD5:	415D5D86B9D5F925A14E5D5C682E7D46
SHA1:	5849BBBBB8D9897C77D1FFEDCAEA7EC352AB0FED
SHA-256:	123BF66115C282B89CCB2AB12632CD36CB73D72A72BA6CC01ECFEE444A516B5D
SHA-512:	FB3961075E68210F8D5A46D75C8B0753131186E24F0026FF9BC78B717BB44B895228E6047C332DDC418E30AFED90E8F0215024DCA79E3AD00B0F4216935F1486
Malicious:	false
Reputation:	unknown
Preview:	{.. "name": "VisBridge",.. "version": "1.0.3",.. "lockfileVersion": 2,.. "requires": true,.. "packages": {.. "": {.. "name": "VisBridge",.. "version": "1.0.3",.. "license": "CC0-1.0",.. "dependencies": {.. "electron-squirrel-startup": "^1.0.0".. },.. "devDependencies": {.. "@electron-forge/cli": "^6.0.0-beta.54",.. "@electron-forge/maker-dmg": "^6.0.0-beta.54",.. "@electron-forge/maker-squirrel": "^6.0.0-beta.54",.. "electron": "^10.1.4".. }.. },.. "node_modules/@electron-forge/async-ora": {.. "version": "6.0.0-beta.54",.. "resolved": "https://registry.npmjs.org/@electron-forge/async-ora/-/async-ora-6.0.0-beta.54.tgz",.. "integrity": "sha512-OCoHds0BIXaB54HgKw6pjlHC1cnaTcfJfVVkPSJl1GLC3VShZ5bETJfsitwbiP2kbfKLUQFayW27sqbwnwQR2w==",.. "dev": true,.. "dependencies": {.. "colors": "^1.4.0",.. "debug": "^4.1.0",.. "log-symbols": "^4.0.0",.. "ora": "^5.0.0"

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\package.json Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	571
Entropy (8bit):	4.70296397320282
Encrypted:	false
SSDEEP:
MD5:	11BBAE4DBCEC65E57A3E297A4593F7DF
SHA1:	CE4633036C40C7CBD8BC87692F628CF6662529B5
SHA-256:	682FCE62CD552F56CC22D0A44A475A409B4C9CB01DD9AF3DCC0E8851402A7BAF
SHA-512:	AAA3BFFE7ED77D8AFF46F7656D6A109E6D08F34154D836FB60A4366304B9068B66740143BD676FF1DDCE25E6DA9472A0CCA3401F5BAE176F1732C029ED9A1496
Malicious:	false
Reputation:	unknown
Preview:	{. "name": "VisBridge",. "version": "1.0.4",. "description": "VisManager standalone application",. "main": "main.js",. "scripts": {. "start": "electron-forge start",. "make": "electron-forge make",. "package": "electron-forge package". },. "author": "GTL",. "license": "CC0-1.0",. "devDependencies": {. "@electron-forge/cli": "^6.0.0-beta.54",. "@electron-forge/maker-dmg": "^6.0.0-beta.54",. "@electron-forge/maker-squirrel": "^6.0.0-beta.54",. "electron": "^10.1.4". },. "dependencies": {. "electron-squirrel-startup": "^1.0.0". }.}.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\pepflashplayer.dll Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31305728
Entropy (8bit):	6.640472767098696
Encrypted:	false
SSDEEP:
MD5:	B62DDDE801903903B0ACEC13DCC437ED
SHA1:	3EB50835968E04EDDF20F1CFC5DDD7DFC42EDCCB
SHA-256:	9C104CF6F184296B4BDECD0F1072F7FAA8B06E84634C2FE70EDAAD033B362085
SHA-512:	5D023BC1E5100CDDC7FC28DDB3A221693ABBE0A927D36C900B1884F88FB6ED67D23E856032B9DAEEC3C8D64D4B8E689707539D7049C5A77ADA5CF5DBC85673C7
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$......./..ak.s2k.s2k.s2...2t.s2...2..s2...2A.s2..v3i.s2.n.2o.s2.1.2m.s2P.p3`.s2P.v3(.s2P.w3M.s2k.s2..s2..p3j.s2..w3x.s2..w3T.s2.n.2i.s2b..2m.s2.n.2t.s2k.r2'.s2..v3..s2..s3j.s2..2j.s2k..2j.s2..q3j.s2Richk.s2........................PE..d....[.[.........." .....bU.........lF....................................................`..........................................;..H....B..@......................................T.......................(...................U..............................text....ZU......\U................. ..`.rodata.0....pU......`U............. ..`.rdata....d...U...d..fU.............@..@.data....x...p.......N..............@....pdata..............4..............@..@.tls................................@....gfids..............................@..@_RDATA..(...........................@..@.rsrc...............................@..@.reloc..................

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\preload.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	445
Entropy (8bit):	4.793265959382089
Encrypted:	false
SSDEEP:
MD5:	89A0715E6BC899236C1984CECEC37320
SHA1:	11419FB11BF0935954D4707CC9DDE4A0CFF1EDAA
SHA-256:	2BD0FD7F9D5F67B43D85F7AF4DF259B87DC7C3326DB1DDD03390550F5292A44F
SHA-512:	B0920AE291D19497986FEFDCD9152068A09D7E589408BEF92CBA26F7877FF7C92CC8EBA52A6B616ABA3089EAA96A1FE26638A86F33502CA6B2C4E947D8EEEEA5
Malicious:	false
Reputation:	unknown
Preview:	// All of the Node.js APIs are available in the preload process...// It has the same sandbox as a Chrome extension...window.addEventListener('DOMContentLoaded', () => {.. const replaceText = (selector, text) => {.. const element = document.getElementById(selector).. if (element) element.innerText = text.. }.... for (const type of ['chrome', 'node', 'electron']) {.. replaceText(`${type}-version`, process.versions[type]).. }..})..

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\renderer.js Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	299
Entropy (8bit):	4.456398287631657
Encrypted:	false
SSDEEP:
MD5:	448DDEE3EBDF881C828E9F11CCC41AAD
SHA1:	21F43CF7F1ABD5F60A130B466A9873DF04EAE2E3
SHA-256:	B952BDF814C083A8814A5FDB5F9450D184CA353032C959E411A41AB0959E37CE
SHA-512:	B53DD1809DDB8BAFAC9EC29473D0E9B5FF9EF943AD46CF5B34C3864D0FFC9B5517D34F7D7148739C3214CFAFC3A5A29FBADA88D6EF3E6CCC0F05055D56F7053B
Malicious:	false
Reputation:	unknown
Preview:	// This file is required by the index.html file and will..// be executed in the renderer process for that window...// No Node.js APIs are available in this process because..// `nodeIntegration` is turned off. Use `preload.js` to..// selectively enable features needed in the rendering..// process...

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\snapshot_blob.bin Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	51261
Entropy (8bit):	7.987363968648695
Encrypted:	false
SSDEEP:
MD5:	37888E00D494DF7A7692D2736C22D8BD
SHA1:	817A3022998B65354691FDF3A16A0C290C3524A2
SHA-256:	84DF747179C96DD8D63F310495DE465C39EFF8AA575D5082257BDDDBD998E1C1
SHA-512:	BBA9CC1F13E39556E372C18F2B59F259960AD6F822F3DC5F80A6E7E3BDD322BA027A306D5EED8DDACECD2B884CBF23D2A30703D1AAA235BB5F24FFE1F43B79A1
Malicious:	false
Reputation:	unknown
Preview:	...........8.5.210.26-electron.0............................................_...............{\|T..?<...>'+.....@.B...%Jt..M..A.F...Fs#.J....k.XbE..+...#>..+..(X...+H.X.`........09f.X....}..aef.Y..^.....g...#M&..w+...u.....\|..O.....}...~......T.......i.Iw..>........_~.._.cWRT..C..aj.v.......[A.sU.^..]......"..;.v./....z./}..j..A.KoGl.n...76....f.....v..x{...o..xs..w@....)..8.w...._z{......m.. U.7.........[...4.i.i.tS.k..Eu.,.Y.e.,..gh6cq..;\.N...N...`_!....j..;...r.KU...\"...j..}....../..p.~=. ...3.A.r..0...........$..............fs.W....p...........0..a"L.i0..P..0...\|...A9,....zX.7@...[.60.:..~......x...G.qx.....<..Ux.......G.(..O.s......8...)...P..+..@..c..R G.I.LU W.<....)P.@..%.,P.T.......T.\.....X.@..-...V.v..+.A...lR`..[..@........:........>..+p@.n..+..1.z.8..I.N)..`U...W.M.$...0\.4.2T..B..9LRa.....BH."..U(Qa....U...U.R..4...j..UhQ.U.....^..lTa...U..V.:T..v.v........W......_..*t.pX.........N.pJ...V38..5.f.$3.5.p3..!..c.e..3L2.T3.

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1830120
Entropy (8bit):	5.886179785302717
Encrypted:	false
SSDEEP:
MD5:	C45A02058073AEB5783F40F78CBF6130
SHA1:	559D64954F25355775E44708C83CC231B042ABF9
SHA-256:	B353A149830EBBB9DD6F0B277F399F489B604C0224448F6300D64EF6162B0073
SHA-512:	DDA56D82B516292FE3CDB9F61069C7216361AC68864161119B0F454B0D258451CDBE1F94F73033EE90C5EF3214B8CA97C61475F1EC103D379C92FA5BBBEAA638
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\\................................. ........@.. .......................@.......+....@.....................................W............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......@...D.............................................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... .A. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X*..0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....%..{......................

C:\Users\user\AppData\Local\VisBridge\app-1.0.4\v8_context_snapshot.bin Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	171499
Entropy (8bit):	7.9955790836903144
Encrypted:	true
SSDEEP:
MD5:	E6206AADD29EB87AB1D398266885B5A4
SHA1:	6BDB54ED5FE55C9A1977CF2F3B27BC0ED560A889
SHA-256:	E55F6E08FF8BAED84B5DE903466311AE08B15E99DBBEA2B5764D855A52E6FAD8
SHA-512:	82739CCBF1823DCE179EBA73948F1F2263213D12D684282DFAAED3F147528074DF82468453ED33B504D10D84357D834C0F29D928274D45DDFDC69A88989F2522
Malicious:	false
Reputation:	unknown
Preview:	.........jJW8.5.210.26-electron.0............................................9..:w.......&.......1.....M..?>.a.9s~.s..s.!.!."3.....B.33{f.g....0.BQ...JQ.W.p.KQ.E.n.EqSQ....^..k..^{.~..\|.......y....Y..{..\|.....w.0i...YzR.o..]..#)..........~.~...M~............d.Q........Q8.P]..]..J........3....ex.>kQ..z..}.v.q..~...#....?tm..II.....g...{.t.....nL.....$.,._&....\|f./k..507v...YgT..G~s..M.e .-...x.37E..6..y2...ge..e...?~NF.c...'.w..,...x_2+.\F..6.......x...We.Z.VFL\|Ee.....2..7LQ...M2..Cu.[d..j.(%%.^.ZI..J....H.A.9u.(tkF.{..IOO....I...oI...h..l...O......}.(.....s..=..Y`v..E.e../.WZ...._3.......~.?.8.I........................_...G.V.B-!UH...[.'...B3..p..N.(t...z.~..._....C...QB.P...J!...&.S..'...$a..PxVxAxIxEX-.......%.#.'\| \|$\|"..>.........~.~.~.~.~...L&!.$....Ip...I.o....&&..Ihe....&..I.j....,..c....\..o....a&a.I....$.MB.I.k..&..$L2.SM.t.0.$.6..L."..IXj.....&.U...$l0..L.....$.0..L.....$.4..M.Q.p.$.4..M...p.$\0..L...p.$..B.YH3.6..4...P.,44.M.Bs...,.1...B'.

C:\Users\user\AppData\Local\VisBridge\packages\VisBridge-1.0.4-full.nupkg Download File
Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	86206808
Entropy (8bit):	7.997914386294035
Encrypted:	true
SSDEEP:
MD5:	070CA605F2C06710E83C21B29B786499
SHA1:	B409029996343C5B19AA9CFD7B18BCDDED443F26
SHA-256:	BD373CB5E6AA47D876C8A436F5D4C6FF5A54BB99685F0BC57AF4FB3319B7CDE1
SHA-512:	62CE2D551A0C63297CF58FB4E4860A697A0BF7C9928B225F017E77CC2C97D952B5D125D3305D2FB23C5E99F5ADDCD7565F664FEEF730FB3474B6231E618C1036
Malicious:	false
Reputation:	unknown
Preview:	PK........"..Q................lib/PK........$..Q................lib/net45/PK........#..Q.J.....r... ...lib/net45/chrome_100_percent.pak..uTTQ....-.]..))...>.$.....D@$.F....n...T.nX.iD:fg{....{.3...}3o.=_....,...=..(.i......'.aN...+... B....H.6.........8O.@.b.).......).R...x....E'....g..HW.d. K....lEg6......(R\|..@.b.8.%......I.`..P..#uGi...d.0Q....T....9...\|P.Q. W.[..<.1u.....P.n...9.74.(S...\=4....$...E...PJ..VPR....h9.6....[...{................W....I....i.^Ad.......p.H....:....R>...!O...(....0.0..u........!&B...p.a ..'..Ph..0..%..C.T0.....@$.K..QP!...'#..B.L0..I..@"....I.....A..0..eJ.@&$'..Y.$....sY..8.....W..r.`4. .<..C.h.@..0P.I.@..s....m4K..{0P..+.@..Q...;.a..Bi.@%....UP...TCI.a.....ZHQ... }........<..OP.!.4A!.0...%.@.D...Z..4..d.h.pwa..T.....q8.tA..p..IG.A.T.f/....}P....Z...@d.p0..9.....0.$..F ..8..M...JK..Q.i........!.d8..dS.`..M..i.n&.. xr.`....b..y.[.., :.\Dl.....s..,#0..`.......? .......5.f...#$j.`.Q..O.D-.l">...P...m...;..z8.El...p......4.!.?..!"....4..

C:\Users\user\AppData\Roaming\VisBridge\7dac6151-2d41-40ea-8920-787a8ad436aa.tmp Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.283088322451805
Encrypted:	false
SSDEEP:
MD5:	58127C59CB9E1DA127904C341D15372B
SHA1:	62445484661D8036CE9788BAEABA31D204E9A5FC
SHA-256:	BE4B8924AB38E8ACF350E6E3B9F1F63A1A94952D8002759ACD6946C4D5D0B5DE
SHA-512:	8D1815B277A93AD590FF79B6F52C576CF920C38C4353C24193F707D66884C942F39FF3989530055D2FADE540ADE243B41B6EB03CD0CC361C3B5D514CCA28B50A
Malicious:	false
Reputation:	unknown
Preview:	{"spellcheck":{"dictionaries":["en-US"],"dictionary":""}}

C:\Users\user\AppData\Roaming\VisBridge\Code Cache\js\index Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	ISO-8859 text, with no line terminators, with escape sequences
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..................

C:\Users\user\AppData\Roaming\VisBridge\Code Cache\js\index-dir\temp-index Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:
MD5:	B7CC8E5DE024751DC8BD4603A2CF6A4F
SHA1:	416FC127115B938851600A43E603F0F7C0A17397
SHA-256:	F8D2483E11C5DDA1452EFF06F2F052430E74E6E4730AF7E24E8F855FA59467D0
SHA-512:	CA95FD6805CAB6B5CE091B3225D0130DEC7DCEF658FCC6B1264A161D7603AF04EAC399C2F344E93DAFE28E0D9CB13C6987676B55B59772497843D8ECED83D23F
Malicious:	false
Reputation:	unknown
Preview:	(...,m..oy retne............................v,/.

C:\Users\user\AppData\Roaming\VisBridge\Code Cache\js\index-dir\the-real-index0 (copy) Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:
MD5:	B7CC8E5DE024751DC8BD4603A2CF6A4F
SHA1:	416FC127115B938851600A43E603F0F7C0A17397
SHA-256:	F8D2483E11C5DDA1452EFF06F2F052430E74E6E4730AF7E24E8F855FA59467D0
SHA-512:	CA95FD6805CAB6B5CE091B3225D0130DEC7DCEF658FCC6B1264A161D7603AF04EAC399C2F344E93DAFE28E0D9CB13C6987676B55B59772497843D8ECED83D23F
Malicious:	false
Reputation:	unknown
Preview:	(...,m..oy retne............................v,/.

C:\Users\user\AppData\Roaming\VisBridge\Code Cache\wasm\index Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	ISO-8859 text, with no line terminators, with escape sequences
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..................

C:\Users\user\AppData\Roaming\VisBridge\Code Cache\wasm\index-dir\temp-index Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:
MD5:	0D29873F626624DB8821DCBDA3AA1EF4
SHA1:	BC1E23A4837664BB711A392D825074FD9FE5EC0A
SHA-256:	4BE435B2F4BFE22A852EB0A90E97087192116ECAE9C20A4B3C3E224A58B27FED
SHA-512:	169166C42E8C3BE6069C3283999660EF565B2733FFB7B3D0808E8F04ACFCF5E5CC1B4D63D21D5B2381E4B07E8370702B141ECEC4D157FFD80F1D1076BE0E5C6C
Malicious:	false
Reputation:	unknown
Preview:	(....pJDoy retne........................g+..v,/.

C:\Users\user\AppData\Roaming\VisBridge\Code Cache\wasm\index-dir\the-real-index.. (copy) Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:
MD5:	0D29873F626624DB8821DCBDA3AA1EF4
SHA1:	BC1E23A4837664BB711A392D825074FD9FE5EC0A
SHA-256:	4BE435B2F4BFE22A852EB0A90E97087192116ECAE9C20A4B3C3E224A58B27FED
SHA-512:	169166C42E8C3BE6069C3283999660EF565B2733FFB7B3D0808E8F04ACFCF5E5CC1B4D63D21D5B2381E4B07E8370702B141ECEC4D157FFD80F1D1076BE0E5C6C
Malicious:	false
Reputation:	unknown
Preview:	(....pJDoy retne........................g+..v,/.

C:\Users\user\AppData\Roaming\VisBridge\GPUCache\data_0 Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\VisBridge\GPUCache\data_1 Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012096502606932763
Encrypted:	false
SSDEEP:
MD5:	259E7ED5FB3C6C90533B963DA5B2FC1B
SHA1:	DF90EABDA434CA50828ABB039B4F80B7F051EC77
SHA-256:	35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
SHA-512:	9D401053AC21A73863B461B0361DF1A17850F42FD5FC7A77763A124AA33F2E9493FAD018C78CDFF63CA10F6710E53255CE891AD6EC56EC77D770C4630F274933
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\VisBridge\GPUCache\data_2 Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\VisBridge\GPUCache\data_3 Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\VisBridge\GPUCache\index Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796353
Category:	dropped
Size (bytes):	368
Entropy (8bit):	0.3511578769559919
Encrypted:	false
SSDEEP:
MD5:	DA5BB6DEC39C1E770BA5CB770EBC6496
SHA1:	A4816E9EB8F1F7CA612246E272FAD6C61FD0D793
SHA-256:	5D91258634D520167BFBE4DC8E78CBC13A42D5A8272C682F11565DD2C9A2DBE2
SHA-512:	630C84A3421EFABD448B235635972DB269AF8D1DB49A80C75EB4562B085CA5800979BCF982D70DF2393443320EC435DA4798DEA672F71D4DEE9A9D0968EB5EAF
Malicious:	false
Reputation:	unknown
Preview:	........................................[i..v,/.................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\VisBridge\Local Storage\leveldb\000001.dbtmp Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\VisBridge\Local Storage\leveldb\CURRENT (copy) Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Roaming\VisBridge\Local Storage\leveldb\LOG Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	128
Entropy (8bit):	5.340346462063166
Encrypted:	false
SSDEEP:
MD5:	00A24D82CC2AE60F36AC4C65B3FCEEC2
SHA1:	D7BE6AE42EB438E362681ED6F97AEE2FB46C6C40
SHA-256:	8F73A65A93CE829C98EEF4D3269401B6CC05AEEC6CC87A993FA03D046C60ABCF
SHA-512:	A441CA9349CECABCC117B9790E26B317639F3F0CFDC01667A4C12886825A24248D1E9C39D1B36493C31F4CEA548F8DD8F23DA60306917653D94905E42763F28E
Malicious:	false
Reputation:	unknown
Preview:	2021/10/08-17:29:55.357 88c Reusing MANIFEST C:\Users\user\AppData\Roaming\VisBridge\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Roaming\VisBridge\Local Storage\leveldb\MANIFEST-000001 Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	PGP\011Secret Key -
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Roaming\VisBridge\Preferences. (copy) Download File
Process:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.283088322451805
Encrypted:	false
SSDEEP:
MD5:	58127C59CB9E1DA127904C341D15372B
SHA1:	62445484661D8036CE9788BAEABA31D204E9A5FC
SHA-256:	BE4B8924AB38E8ACF350E6E3B9F1F63A1A94952D8002759ACD6946C4D5D0B5DE
SHA-512:	8D1815B277A93AD590FF79B6F52C576CF920C38C4353C24193F707D66884C942F39FF3989530055D2FADE540ADE243B41B6EB03CD0CC361C3B5D514CCA28B50A
Malicious:	false
Reputation:	unknown
Preview:	{"spellcheck":{"dictionaries":["en-US"],"dictionary":""}}

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9988820421364
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	VisBridge-1.0.4+Setup.exe
File size:	86984728
MD5:	b33f67f583b9c1f1f726d15b249d4242
SHA1:	6b554808aa148de2686fbd434f0d20b344bd3b60
SHA256:	081dbbe7d110a89155e0cd7800bc9c1a714e82ceecfa3ef80e733043387b000b
SHA512:	05e8498789aa393284c82044f07dce4d2a71e7748cb068d1260ce98b33cac9e2a8c49076cd90044deb5e73a42f5c1be9dc7f1319ffbbd668cefbbecda08535a9
SSDEEP:	1572864:FSP1UmwZ3rgRXWbNUP7O9ovh7QRCLe1uNsJ/lsfrza02OLdSVngKX2+0YP:Fbb2XGUPSihURCqaY/lsDj2OLY9xl0YP
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...,...,...,..0....,..0....,..0....,...(...,.../...,.\|S....,...)...,.\|S....,.\|S....,...-.;.,.3.%...,.3.....,.......,.3.....,

File Icon


Icon Hash:	f0968eecaaeca892

Static PE Info

General
Entrypoint:	0x40ab0b
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5C5CF096 [Fri Feb 8 02:59:34 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	bcf80497fe587a3956d64dc513da9548

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	12/3/2020 4:00:00 PM 12/7/2021 3:59:59 PM
Subject Chain	CN=Global TelLink Corporation, O=Global TelLink Corporation, L=Falls Church, S=Virginia, C=US, SERIALNUMBER=623049, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Idaho, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	C387518D605BE1F3D688AE99C5073C06
Thumbprint SHA-1:	CF32CEC509AC2D230E0DBDDF10BDD3FEC3104E32
Thumbprint SHA-256:	D7E8A67A1B8A39F64AC6C61EC2C18749B1F1DAF9D64F0D2BFA2B69F188D147ED
Serial:	08DA6E067C3E6BCC09AA120FBD6A23DB

Entrypoint Preview

Instruction
call 00007F2A40E5671Dh
jmp 00007F2A40E5603Fh
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F2A40E5621Dh
mov dword ptr [esi], 0041E44Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0041E454h
mov dword ptr [ecx], 0041E44Ch
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F2A40E561EAh
mov dword ptr [esi], 0041E468h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0041E470h
mov dword ptr [ecx], 0041E468h
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0041E42Ch
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F2A40E5792Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0041E42Ch
push eax
call 00007F2A40E57978h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0041E42Ch
push eax
call 00007F2A40E57961h
test byte ptr [ebp+08h], 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x282cc	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2b000	0x52c8694	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x52f2a00	0x1e18
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x52f4000	0x1928	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x266f0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1e388	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x1a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x27e90	0xe0	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1c82b	0x1ca00	False	0.587012145197	data	6.65400129577	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x1e000	0xac3a	0xae00	False	0.443830818966	data	4.94244604691	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29000	0x1750	0xc00	False	0.244791666667	data	3.27959027222	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2b000	0x52c8694	0x52c8800	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x52f4000	0x1928	0x1a00	False	0.770132211538	data	6.52899094753	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
DATA	0x2b310	0x52c5c78	Zip archive data, at least v2.0 to extract	English	United States
FLAGS	0x52f0f88	0xc	data	English	United States
RT_ICON	0x52f0f94	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2004318071, next used block 15794040	English	United States
RT_ICON	0x52f127c	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x52f1b24	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 2004318071, next used block 15794040	English	United States
RT_ICON	0x52f1e0c	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_STRING	0x52f26b4	0x418	data	English	United States
RT_STRING	0x52f2acc	0x472	data	English	United States
RT_GROUP_ICON	0x52f2f40	0x22	data	English	United States
RT_GROUP_ICON	0x52f2f64	0x22	data	English	United States
RT_VERSION	0x52f2f88	0x324	data	English	United States
RT_MANIFEST	0x52f32ac	0x3e7	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	LoadResource, FindResourceW, lstrlenW, GetProcAddress, GetModuleHandleW, DeleteCriticalSection, GetTempPathW, GetLastError, GetTempFileNameW, MoveFileW, WaitForSingleObject, GetExitCodeProcess, CloseHandle, DeleteFileW, GetModuleFileNameW, GetCurrentProcess, LoadLibraryW, FreeLibrary, InitializeCriticalSectionEx, GetFileAttributesW, CreateFileW, SetFilePointer, ReadFile, VerSetConditionMask, GetCurrentDirectoryW, MultiByteToWideChar, LocalFileTimeToFileTime, WideCharToMultiByte, CreateDirectoryW, WriteFile, SetFileTime, FreeResource, SizeofResource, LockResource, CreateProcessW, GetSystemDirectoryW, SetDefaultDllDirectories, GetCurrentThreadId, DecodePointer, RaiseException, LeaveCriticalSection, EnterCriticalSection, lstrcmpiW, LoadLibraryExW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, SystemTimeToFileTime, VerifyVersionInfoW, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsDebuggerPresent, OutputDebugStringW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitProcess, GetModuleHandleExW, GetStdHandle, GetACP, HeapFree, HeapAlloc, GetFileType, CompareStringW, LCMapStringW, HeapSize, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap, SetStdHandle, GetStringTypeW, FlushFileBuffers, WriteConsoleW
SHLWAPI.dll	PathIsUNCW
COMCTL32.dll	InitCommonControlsEx

Version Infos

Description	Data
LegalCopyright	Copyright 2020 GTL
InternalName	Setup.exe
FileVersion	1.0.4
CompanyName	GTL
SquirrelAwareVersion	1
ProductName	VisManager standalone application
ProductVersion	1.0.4
FileDescription	VisManager standalone application
OriginalFilename	Setup.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2021 17:29:59.531618118 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:29:59.531677008 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:29:59.531805038 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:29:59.571326971 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:29:59.571363926 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:29:59.611315012 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:29:59.611449003 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:29:59.619234085 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:29:59.619265079 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:29:59.619533062 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:29:59.659359932 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.008625984 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.051142931 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.576205969 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.576265097 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.576296091 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.576322079 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.576335907 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.576347113 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.576371908 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.576387882 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.578732014 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.578764915 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.579881907 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.579925060 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.579952955 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.579961061 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.579974890 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580004930 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.580213070 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580250978 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580266953 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.580288887 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580332041 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580369949 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580404997 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580430984 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.580446005 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580459118 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580481052 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.580522060 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580532074 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.580544949 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580569029 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.580585003 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580621958 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580658913 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.580662966 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580677032 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.580760002 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.581178904 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.581224918 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.581310034 CEST	443	49839	185.199.108.133	192.168.2.7
Oct 8, 2021 17:30:00.581331015 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.581398010 CEST	49839	443	192.168.2.7	185.199.108.133
Oct 8, 2021 17:30:00.598149061 CEST	49839	443	192.168.2.7	185.199.108.133

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2021 17:29:59.479645014 CEST	64296	53	192.168.2.7	8.8.8.8
Oct 8, 2021 17:29:59.498513937 CEST	53	64296	8.8.8.8	192.168.2.7
Oct 8, 2021 17:30:29.424072981 CEST	52286	53	192.168.2.7	8.8.8.8
Oct 8, 2021 17:30:29.442071915 CEST	53	52286	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 8, 2021 17:29:59.479645014 CEST	192.168.2.7	8.8.8.8	0xd18e	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)
Oct 8, 2021 17:30:29.424072981 CEST	192.168.2.7	8.8.8.8	0x6f9e	Standard query (0)	www.gtlvisitme.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Oct 8, 2021 17:29:59.498513937 CEST	8.8.8.8	192.168.2.7	0xd18e	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)
Oct 8, 2021 17:29:59.498513937 CEST	8.8.8.8	192.168.2.7	0xd18e	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)
Oct 8, 2021 17:29:59.498513937 CEST	8.8.8.8	192.168.2.7	0xd18e	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)
Oct 8, 2021 17:29:59.498513937 CEST	8.8.8.8	192.168.2.7	0xd18e	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)
Oct 8, 2021 17:30:29.442071915 CEST	8.8.8.8	192.168.2.7	0x6f9e	No error (0)	www.gtlvisitme.com	38.90.155.59	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

raw.githubusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49839	185.199.108.133	443	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-08 15:30:00 UTC	0	OUT	GET /electron/electron/master/shell/browser/resources/win/electron.ico HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2021-10-08 15:30:00 UTC	0	IN	HTTP/1.1 200 OK Connection: close Content-Length: 37073 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: image/vnd.microsoft.icon ETag: "2a6f576280d6c49e158ea295d0e0205e2b5ed5d60e059a32a0a14ea10bc58fe9" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: AAA8:CD46:A174F6:B03999:615FF087 Accept-Ranges: bytes Date: Fri, 08 Oct 2021 15:30:00 GMT Via: 1.1 varnish X-Served-By: cache-mxp6976-MXP X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1633707000.016076,VS0,VE549 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * X-Fastly-Request-ID: 3f5fa26ee8399dd8e8b67c3fe115b1b4412089ec Expires: Fri, 08 Oct 2021 15:35:00 GMT Source-Age: 0
2021-10-08 15:30:00 UTC	0	IN	Data Raw: 00 00 01 00 04 00 10 10 00 00 01 00 20 00 28 05 00 00 46 00 00 00 20 20 00 00 01 00 20 00 28 14 00 00 6e 05 00 00 30 30 00 00 01 00 20 00 28 2d 00 00 96 19 00 00 00 00 00 00 01 00 20 00 13 4a 00 00 be 46 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 d8 d8 ff d8 d8 d8 ff d8 d8 d8 ff d8 d8 d8 ff bd bb bb ff 7f 78 77 ff 54 4a 48 ff 42 36 34 ff 42 36 34 ff 54 4a 48 ff 7f 78 77 ff bd bb bb ff d8 d8 d8 ff d8 d8 d8 ff d8 d8 d8 ff d8 d8 d8 ff d8 d8 d8 ff d8 d8 d8 ff d4 d4 d4 ff 7c 75 74 ff 3b 2f 2d ff 3a 2e 2c ff 3c 30 2e ff 77 6c 5f ff 6a 60 55 ff 3b 2f 2d ff 3a 2e 2c ff 3b 2f 2d ff 7c 75 74 ff d4 d4 d4 ff d8 d8 d8 ff d8 d8 d8 ff d8 d8 d8 ff d4 d4 d4 ff 62 5a 58 ff 3a 2e 2c ff 3a Data Ascii: (F (n00 (- JF( xwTJHB64B64TJHxw\|ut;/-:.,<0.wl_j`U;/-:.,;/-\|utbZX:.,:
2021-10-08 15:30:00 UTC	2	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 55 55 06 3d 2f 2f 47 3a 2e 2c 95 3b 2f 2c bf 3b 2f 2d d9 3b 2e 2c f3 3b 2e 2c f3 3b 2f 2d d9 3b 2f 2c bf 3a 2e 2c 95 3d 2f 2f 47 55 55 55 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 35 35 18 3c 30 2c 96 3a 2f 2c f1 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c Data Ascii: ( @ UUU=//G:.,;/,;/-;.,;.,;/-;/,:.,=//GUUU@55<0,:/,:.,:.,:.,:.,:.,:.,:.,:.,
2021-10-08 15:30:00 UTC	3	IN	Data Raw: 3d ff 46 3b 36 ff 7c 72 63 ff d9 d1 b1 ff d8 d0 af ff 84 7a 6a ff 4b 40 3b ff 3a 2e 2c ff 99 8f 7a ff 9c 93 7e ff 3a 2e 2c ff 7f 75 66 ff ff f7 cf ff ff f7 cf ff bf b6 9b ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2f 2c f1 55 55 55 06 3d 2f 2f 47 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff b4 ac 92 ff fb f4 cc ff a2 98 82 ff 3a 2e 2c ff 3a 2e 2c ff 50 45 3e ff c9 c1 a2 ff d6 ce ad ff 71 67 5a ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 73 69 5c ff c9 c1 a2 ff 3a 2e 2c ff 4a 3f 3a ff e0 d8 b5 ff f6 ee c8 ff 75 6b 5d ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3d 2f 2f 47 3a 2e 2c 95 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 75 6b 5d ff cf c6 a7 ff 3a 2e 2c ff 3a 2e 2c ff 75 6b 5d ff ee Data Ascii: =F;6\|rczjK@;:.,z~:.,uf:.,:.,:.,:.,:/,UUU=//G:.,:.,:.,:.,:.,:.,:.,PE>qgZ:.,:.,:.,:.,si\:.,J?:uk]:.,:.,:.,:.,:.,=//G:.,:.,:.,:.,:.,:.,uk]:.,:.,uk]
2021-10-08 15:30:00 UTC	5	IN	Data Raw: 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 56 4b 44 ff cf c7 a8 ff ea e2 be ff ca c2 a3 ff c5 bd 9f ff d8 d0 af ff 70 65 58 ff 3a 2e 2c ff 5a 4f 47 ff 9f 95 80 ff db d3 b1 ff d0 c7 a9 ff f0 e8 c3 ff b0 a7 8e ff dd d5 b4 ff f3 eb c5 ff b0 a7 8e ff 40 35 32 ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2f 2c f1 55 55 55 06 00 00 00 00 3c 30 2c 96 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 52 47 40 ff 6e 63 58 ff 72 67 5b ff 5f 55 4b ff 3d 32 30 ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 9b 92 7d ff b2 a9 90 ff 5c 51 49 ff 59 4e 46 ff 3b 2f 2d ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3c 30 2c 96 00 00 00 00 00 00 00 00 40 35 35 18 3b 2f 2d f4 3a 2e 2c Data Ascii: :.,:.,:.,VKDpeX:.,ZOG@52:.,:.,:.,:.,:.,:/,UUU<0,:.,:.,:.,:.,:.,:.,:.,RG@ncXrg[_UK=20:.,:.,:.,:.,}\QIYNF;/-:.,:.,:.,:.,:.,:.,:.,<0,@55;/-:.,
2021-10-08 15:30:00 UTC	6	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2021-10-08 15:30:00 UTC	7	IN	Data Raw: 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2f 2d f5 3a 2f 2d af 3a 30 2d 60 3c 3c 2d 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d 33 33 0a 3c 2f 2d 7c 3b 2e 2c f2 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3b 2e 2c f2 3c 2f 2d 7c 4d 33 33 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: :.,:.,:.,:/-:/-:0-`<<-M33</-\|;.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,;.,</-\|M33
2021-10-08 15:30:00 UTC	9	IN	Data Raw: 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3b 2e 2c f7 3c 2e 2e 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 2f 2f 1b 3b 2f 2c e6 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 46 3b 36 ff e5 dd ba ff e7 df bc ff 61 56 4d ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff a2 98 82 ff ff f7 cf ff 9c 93 7e ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3b 2f 2c e6 42 2f 2f 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 Data Ascii: ,:.,:.,:.,:.,:.,;.,<..7B//;/,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,F;6aVM:.,:.,:.,:.,~:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,;/,B//U
2021-10-08 15:30:00 UTC	10	IN	Data Raw: 3a 2e 2c ff 3a 2e 2c ff 3a 30 2d 60 00 00 00 00 00 00 00 00 3a 2f 2d af 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff b4 ab 91 ff ff f7 cf ff fb f4 cc ff fe f7 cf ff 79 6f 60 ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 47 3b 37 ff b8 af 95 ff ff f7 cf ff e2 da b7 ff 86 7c 6b ff 3e 32 2f ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 43 37 33 ff fc f5 cd ff 9c 93 7e ff 3a 2e 2c ff 3a 2e 2c ff 3e 32 2f ff da d2 b1 ff ff f7 cf ff fb f4 cc ff f8 f0 c9 ff 59 4e 46 ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2f 2d af 00 00 00 00 55 39 39 09 3a 2f 2d f5 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3d 32 30 ff fd f6 ce ff cf c7 a8 ff 69 5f 54 Data Ascii: :.,:.,:0-`:/-:.,:.,:.,:.,:.,:.,yo`:.,:.,:.,:.,G;7\|k>2/:.,:.,:.,:.,:.,:.,C73~:.,:.,>2/YNF:.,:.,:.,:.,:.,:.,:/-U99:/-:.,:.,:.,:.,:.,:.,=20i_T
2021-10-08 15:30:00 UTC	11	IN	Data Raw: 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 40 34 31 ff b4 ab 91 ff fe f7 cf ff 78 6e 60 ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff c4 bb 9f ff ff f7 cf ff ff f7 cf ff 62 57 4e ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 6a 60 55 ff ff f7 cf ff 6b 60 54 ff 3a 2e 2c ff 5f 54 4a ff fa f3 cc ff bc b3 98 ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c f9 3a 2e 2c f9 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff d2 ca aa ff ba b1 96 ff d0 c7 a9 ff f8 f1 ca ff 6b 60 54 ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a Data Ascii: ,:.,:.,:.,:.,:.,@41xn`:.,:.,:.,:.,:.,:.,:.,:.,bWN:.,:.,:.,:.,j`Uk`T:.,_TJ:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,k`T:.,:.,:.,:.,:.,:
2021-10-08 15:30:00 UTC	13	IN	Data Raw: 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3d 31 2f ff 91 87 74 ff ed e5 c0 ff ff f7 cf ff cc c4 a6 ff 6c 62 56 ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 70 66 59 ff ff f7 cf ff 80 76 66 ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 9c 92 7d ff ff f7 cf ff 4f 44 3e ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2f 2d f5 55 39 39 09 00 00 00 00 3a 2f 2d af 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 5f 54 4a ff f4 ed c7 ff da d2 b1 ff 57 4c 44 ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 40 35 32 ff 8e 85 73 ff ea e1 be ff ff f7 cf ff e0 d8 b5 ff a3 99 83 ff 66 5c 51 ff 3b 2f 2d ff 3a 2e 2c Data Ascii: :.,:.,:.,:.,:.,=1/tlbV:.,:.,:.,:.,:.,pfYvf:.,:.,:.,:.,}OD>:.,:.,:.,:.,:.,:.,:.,:/-U99:/-:.,:.,:.,:.,:.,:.,:.,_TJWLD:.,:.,:.,:.,:.,:.,:.,@52sf\Q;/-:.,
2021-10-08 15:30:00 UTC	14	IN	Data Raw: 69 ff ff f7 cf ff d8 d0 af ff f3 eb c5 ff f3 eb c5 ff ff f7 cf ff c7 be a1 ff 3d 32 30 ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3b 2e 2d cb 55 55 55 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 2f 2f 1b 3b 2f 2c e6 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff bb b1 97 ff eb e3 bf ff 3a 2e 2c ff 87 7c 6c ff ff f7 cf ff a4 9b 85 ff 3c 30 2e ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a Data Ascii: i=20:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,;.-UUUB//;/,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,\|l<0.:.,:.,:.,:.,:.,:.,:.,:.,:.,:
2021-10-08 15:30:00 UTC	15	IN	Data Raw: 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3b 2f 2c e6 3c 30 2d 66 55 55 55 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d 33 33 0a 3c 2f 2d 7c 3b 2e 2c f2 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3a 2e 2c ff 3b 2e 2c f2 3c 2f 2d 7c 4d 33 33 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: :.,:.,:.,:.,:.,;/,<0-fUUUM33</-\|;.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,:.,;.,</-\|M33
2021-10-08 15:30:00 UTC	17	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2021-10-08 15:30:00 UTC	18	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 06 00 00 00 5c 72 a8 66 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 40 00 49 44 41 54 78 01 ed 5d 07 Data Ascii: PNGIHDR\rfsRGB@IDATx]
2021-10-08 15:30:00 UTC	19	IN	Data Raw: d0 27 be fb de 07 07 5b 31 64 a1 d1 22 40 a0 4a dd ba 29 b5 9a 7b 8c da b9 60 c6 69 11 90 ab 71 12 29 03 90 81 7c fa ce 9d 0e 11 be 41 67 de dc 7f d0 a2 a8 b0 90 e2 23 83 8f 18 6f 2b ea e9 15 d7 69 db e6 b1 b3 87 eb 80 0d 13 26 c4 8a b1 0d 7c d1 4c 3b b8 14 b2 df 2d fc 6d dd 9b 3b f7 a6 a7 27 25 52 c9 3d 29 5c 74 e5 d2 dc c6 b6 a0 4e 87 76 1b f6 ff 3a 7f b6 ae b4 89 6d 3b 28 03 c0 08 4e 5e bb b5 5b e8 93 c7 47 a3 fc 03 ec d8 02 4a 9f 17 3e 02 4e 0d dc 12 6a 35 6f 31 7c db 9c 29 d7 84 4f 2d bf 14 96 6b 06 50 5c 5c 5c e1 eb 99 bf 9c 09 b8 75 ab 5f 61 7e 7e b9 c6 82 df 6e 26 bc d2 f5 0c 0c 8a dd 3a 75 3a 7f d8 6b d9 80 0a 15 2a 14 0b 8f 42 cd 50 54 6e 3b bd a7 d7 ae 3a 01 ff 3e ba 1b e9 f7 ca 5e 33 50 d3 5a 84 88 40 b5 86 ee 71 6e 2d 5b b5 f7 9e 39 fe 8d 10 Data Ascii: '[1d"@J){`iq)\|Ag#o+i&\|L;-m;'%R=)\tNv:m;(N^[GJ>Nj5o1\|)O-kP\\\u_a~~n&:u:k*BPTn;:>^3PZ@qn-[9
2021-10-08 15:30:00 UTC	21	IN	Data Raw: 78 a8 70 aa 55 93 48 ec 85 83 47 88 f1 d2 91 97 0e 1d 95 be fd 78 5d b5 66 8d 8f d7 f4 42 39 04 fc 71 df 85 3e ac 5c 6e ed e4 12 2c 03 00 1b 7e fe d7 6f 6d a0 96 7c 54 eb 18 b0 63 6f 61 63 2d f7 50 6e 76 16 8a 09 0b 97 8b 97 8d 08 0d 7c 2d 1b 25 b9 b7 b5 a7 d6 d3 89 c0 28 88 84 be 0b 7d 18 fa b2 82 6c 5a 4d 12 24 03 80 b5 53 f8 a3 87 77 32 92 a8 0d 3f 75 7a 07 c6 8f f0 18 bb e5 a8 8d 83 03 9a e5 bd 16 d9 39 d2 7d 58 02 b8 8c 51 d0 87 a1 2f 0b 75 3f 40 90 0c 60 f8 f4 85 e7 a3 02 02 a8 f5 5e c6 6e c5 9c 00 b2 fd 69 49 c9 72 19 40 04 58 99 69 bc 4b 7d 37 b9 67 4b 22 e0 94 60 d5 e1 83 58 a4 f8 2b 2a 1b 50 02 8a 12 bf d0 97 87 e1 3e ad 44 56 8d 67 11 1c 03 18 b3 74 fd 94 d7 b7 6f f5 d6 38 12 3a 54 61 64 68 28 b1 35 fd bf fb 86 18 2f 1d d9 17 eb 0b 28 0a c0 48 Data Ascii: xpUHGx]fB9q>\n,~om\|Tcoac-Pnv\|-%(}lZM$Sw2?uz9}XQ/u?@`^niIr@XiK}7gK"`X+*P>DVgto8:Tadh(5/(H
2021-10-08 15:30:00 UTC	22	IN	Data Raw: f2 5d c3 a5 23 c7 d0 bb c0 40 22 08 83 c6 8e 91 ec 15 10 13 69 a4 04 01 18 1b f1 6f de ed d1 24 1c 1a 63 00 33 bc b7 3b 62 0e d7 59 93 8d a3 75 69 16 01 30 46 b2 7b c5 2a a2 af 01 d8 10 1c 34 7e ac 66 09 12 61 6d 61 4f 9f 75 86 b1 a2 29 d2 35 c6 00 a2 df 85 ef ca c9 a4 be fc 34 f5 62 b5 55 cf 3b bc 19 78 eb 0c 79 33 bb cb c0 cf 90 8d 3d 35 f4 a4 e8 dd c0 18 89 0e 0d 27 af a5 14 3d a8 66 9a 46 18 c0 94 2d 07 ad c3 9e 3e a5 56 7e d4 7c 49 62 7b ec e4 ce 3d d8 df 40 8e 1c d9 a0 2b 30 60 d4 77 72 f1 34 a2 34 02 61 be 4f 7b c3 98 29 1d cb cf 9d 46 e4 00 ea b8 36 dc 8f ed a2 b9 f3 d3 04 61 96 0a 2a b2 16 36 56 92 73 f0 2a ce d5 90 73 6d 17 54 b3 be 2b 82 6b 3b 6c 60 d3 d2 c6 06 9b d4 32 c3 f2 f4 46 12 91 dc e2 e2 22 54 58 a8 d8 4d 97 30 5b 2a 4f 55 4e 56 96 a4 Data Ascii: ]#@"io$c3;bYui0F{4~famaOu)54bU;xy3=5'=fF->V~\|Ib{=@+0`wr44aO{)F6a6VssmT+k;l`2F"TXM0[OUNV
2021-10-08 15:30:00 UTC	23	IN	Data Raw: 37 c0 98 60 e9 63 8f dd 96 03 2e 60 da 0c 96 1f 1f 5c 9d 95 bd 8d 05 4c 75 e0 98 d1 a8 be 87 07 fa 1d 33 9a a4 58 f1 2c 0b 60 0c c1 58 c2 30 74 97 c5 85 8b fb b2 d1 53 a3 96 63 c7 8e e9 79 6d 3d 90 93 91 98 c0 1b 83 51 83 2c 85 8f b4 ee d9 1d 4d fa e5 67 6c e2 ca 50 61 3e 48 4c c4 5f b8 c7 37 6f 4b f4 dc 83 f0 ce 33 9c 55 8b 2d c0 6c a3 db e0 cf f1 c0 ef 85 19 0d 3b ab 6c 20 c3 00 12 80 2f ee 3d 90 98 1d 4b 8a 8b 2f 05 87 3e 3e cf f7 39 73 4a 22 fb 50 2a 01 df ec 58 f6 ab 64 d3 4e 36 5e 99 7b 73 2b 4b 3c 63 69 26 59 a6 78 74 68 a7 d4 2c 21 33 2d 0d ad 9f 35 07 1b 37 7d a5 4c 15 82 c8 63 66 6b 57 30 73 ca 08 a3 61 c3 86 71 2e 10 c1 cb 00 3d f7 f2 9d a7 98 06 ff c0 31 a3 d0 97 93 27 e0 97 ad 98 1f 06 3c 79 22 99 46 8a f9 b8 a9 66 3d 57 d4 e7 eb e1 a8 35 3e Data Ascii: 7`c.`\Lu3X,`X0tScym=Q,MglPa>HL_7oK3U-l;l /=K/>>9sJ"P*XdN6^{s+K<ci&Yxth,!3-57}LcfkW0saq.=1'<y"Ff=W5>
2021-10-08 15:30:00 UTC	25	IN	Data Raw: 6f 3f 9a 3e 60 30 da b7 d6 4b 10 83 1f b0 05 5d 08 26 79 0a d0 e4 e3 3b 80 e2 11 08 74 91 42 7b 2c 15 29 f4 90 10 1e 66 02 63 8d 2b 3a 39 63 00 99 31 ef a7 61 a2 38 97 2b e0 aa a1 50 0e c8 93 93 be 9c e0 cb fe fa a9 d3 5c 56 c5 59 59 70 5c 39 6c ea 64 b4 e2 d0 7e 89 af bd b2 0a 86 1d fd ab d8 70 c8 ec 21 c3 d0 b1 2d db 14 4a e8 95 55 16 5f e9 fe 58 7a 90 14 34 c1 00 a0 de cb d8 50 09 29 80 2f 43 10 9a 12 78 a8 f0 df 58 e3 84 4c ce 96 00 19 f1 71 5d 38 a1 88 c7 42 1a b5 6a 49 2c 3d e8 c5 0b 89 42 0a 31 51 8b 91 20 bd f7 dd cc 19 c8 16 9b 18 2b 3b 14 63 95 da ab d8 62 d0 0e 89 32 52 d9 f9 b5 97 23 c4 2f 80 58 79 7d 0f 79 1b 82 c4 8c 2c 23 9f 62 f9 80 34 bc d1 6b 81 7d 1a 4a 07 d0 7e 74 ae 5b 07 85 07 05 4b 47 0b ee 9a cb b1 c6 19 03 48 8c 8e a9 29 38 a4 64 Data Ascii: o?>`0K]&y;tB{,)fc+:9c1a8+P\VYYp\9ld~p!-JU_Xz4P)/CxXLq]8BjI,=B1Q +;cb2R#/Xy}y,#b4k}J~t[KGH)8d
2021-10-08 15:30:00 UTC	26	IN	Data Raw: 01 e4 e5 65 f3 6f c1 81 63 f8 7d ef dc 23 96 08 0e 24 99 24 05 89 0f 10 22 c1 67 1d 0c 7e 45 ae b6 c2 83 83 d1 a2 51 63 d1 cb 07 8f 08 25 94 bf 28 26 93 e3 56 58 33 90 8f 00 6e c9 dd 9a 91 d5 8e 1f 5e b9 ca 47 95 bc 96 99 97 cd 6e 0c b2 62 00 85 d9 59 f2 da 1c bc 36 97 7d e1 60 f3 0f a4 eb 64 03 a8 a2 36 c1 ee b0 d5 0d e0 a3 6e c1 96 cd 72 3a e6 d2 e5 81 ab ea 65 e3 27 e1 65 08 79 f3 4b 3a 6f 79 b9 66 62 00 36 0c 8a 5b 6c 71 01 5b 8a a4 0d 59 10 b5 66 a2 85 6d 9d 7c 3e cf 76 0c b2 62 00 d8 92 8e b2 16 29 f9 c4 40 a5 b2 c1 61 c4 33 86 59 40 cf a1 04 ed 14 25 4a 07 93 d6 b3 bd d7 11 37 96 4a 1e bf 74 f4 18 da 30 77 01 ca cd c9 2d 89 a2 bf 18 01 a6 3d 00 b6 5e 8a 99 c0 6d df 8f ac 77 71 0f 7b 3f 12 63 60 3b 06 59 31 80 c2 fc 7c 1b 31 82 76 e5 e4 29 22 d9 8d Data Ascii: eoc}#$$"g~EQc%(&VX3n^GnbY6}`d6nr:e'eyK:oyfb6[lq[Yfm\|>vb)@a3Y@%J7Jt0w-=^mwq{?c`;Y1\|1v)"
2021-10-08 15:30:00 UTC	27	IN	Data Raw: 5e de e9 52 d0 63 39 06 59 31 80 8a 7a 7a ba 84 e5 c7 b6 0c 99 38 0e b9 36 6d f2 f1 5e fa 02 76 cb b7 2f 5b 21 1d 25 e8 eb ca d8 40 89 ba a1 b2 93 fa cf aa 52 27 33 03 50 6d 09 00 47 9a 43 26 8e 27 56 8d 45 66 d1 ee 95 ab 89 69 62 8e 64 3b 06 59 31 00 3c fd 28 12 33 78 24 da eb 7b 34 41 03 46 8f 24 25 49 ec 08 6c c0 26 bc 72 b2 e4 ed 09 10 1f 10 40 24 5b 23 27 1a 69 42 05 72 37 04 4d 4a 65 83 9d a3 03 9e b5 2d c1 9b b8 e4 b2 8e 6c fa 1d c5 45 45 29 5b 9c 68 f2 b1 1d 83 64 b4 94 6c 7e 05 3d dd 5a 02 c0 79 ff 38 bc 7e 64 ea 44 3b b0 f1 4e 31 19 8d 84 d7 18 47 b0 81 a8 e4 eb 45 4c 9a 7a ca 3e af 6c 3e 43 23 b2 58 75 3e fe 6a 2b 13 e0 88 f3 c7 df 56 30 2e 75 ee 5f fe 47 e2 54 55 99 b2 c4 96 87 ed 18 64 c5 00 f0 8b cb 13 1b 60 8a e8 85 a9 3f 93 39 af ab 27 4e Data Ascii: ^Rc9Y1zz86m^v/[!%@R'3PmGC&'VEfibd;Y1<(3x${4AF$%Il&r@$[#'iBr7MJe-lEE)[hdl~=Zy8~dD;N1GELz>l>C#Xu>j+V0.u_GTUd`?9'N
2021-10-08 15:30:00 UTC	29	IN	Data Raw: 09 01 26 2f c0 ca 2c c3 3e 95 52 3e af b8 18 7b ac 19 80 a9 b5 95 e6 ed 48 b3 78 df 0d 5a b6 20 6e fe c1 f9 be ef 9d bb 6a 97 0c 67 ff cb 27 4c c1 fb 07 cc 72 19 75 1b 37 42 8b f7 ec 90 38 18 51 bb 22 1d 7b 90 c9 0b 30 5d 02 94 fd a2 b9 18 7b ac 19 c0 f6 79 3f 3e 36 34 31 13 cd 49 40 43 06 cb b8 be 77 ee a0 a2 22 76 cd 08 7f 13 82 16 8f 9d 80 4d 84 33 cf cc c0 3d f5 e2 5d db 51 a3 56 65 5b e8 2d bb 0b 88 3f 87 55 e5 ca c4 46 50 06 40 84 e5 63 24 8c 39 18 7b 1f 23 d4 bc 60 cd 00 a0 5e 2b 47 87 34 35 eb d7 f8 63 f5 9b 35 25 d6 f9 e4 d6 1d 62 bc aa 91 29 09 89 68 c5 a4 a9 d8 ac f8 2d c6 47 4d f0 b9 f7 9c 8d 5e e8 cb 29 13 b1 83 51 79 0d 44 c6 07 75 30 c1 86 61 13 30 29 5e 74 7b cb 1a 7d 3b 5c 8d 39 4e 18 80 79 65 fb 40 8d b6 5e cd ca 8c 4d 4d 50 4d 6c ec 52 Data Ascii: &/,>R>{HxZ njg'Lru7B8Q"{0]{y?>641I@Cw"vM3=]QVe[-?UFP@c$9{#`^+G45c5%b)h-GM^)QyDu0a0)^t{};\9Nye@^MMPMlR
2021-10-08 15:30:00 UTC	30	IN	Data Raw: 24 d2 73 b0 f7 31 7a de 6c 44 b2 8f 70 7c eb 76 ec cb 30 ad a4 89 6a fd 82 85 e6 9f 36 6f c0 0c a6 86 5a cf c3 43 0d b1 d6 e8 fb f0 70 cc 8c de aa 5d 06 d7 0f 3a bb 37 0c 3e fc eb 2f 1b b8 2c 97 f3 f9 ad 4d 55 c7 3f b8 24 90 4d 59 2d ba 74 42 bd 86 7d c9 a6 08 c9 b3 20 a0 d3 bc 53 47 d6 e5 28 5b 40 6e 76 36 3a 80 ad 12 2f 1e 3d 5e a1 66 61 49 79 4d db b5 43 2b 0f ee c3 9e 8d e7 61 1f 07 64 d9 fa 92 bc 42 f8 05 86 05 9e 95 64 43 52 5c 1c 1e 74 11 b2 d1 2a df 7f f5 c3 14 54 bd 0e f9 84 41 95 c2 c0 53 34 93 c1 12 55 ca e1 2a 2f 1f 63 8b d3 19 00 34 b4 d3 b0 41 ff c6 04 85 2d 28 cc d3 fe 32 60 fa 9a df 88 ba ff 40 67 42 cc 7b 74 0e 3b c0 3c 7f e0 20 ba 7f f1 32 02 1f 72 55 aa 55 63 9c 7a 57 af 57 17 5d c3 0e 28 34 e9 35 27 05 db 28 b8 79 fa 2c ca c4 c7 94 f5 Data Ascii: $s1zlDp\|v0j6oZCp]:7>/,MU?$MY-tB} SG([@nv6:/=^faIyMC+adBdCR\tTAS4U/c4A-(2`@gB{t;< 2rUUczWW](45'(y,
2021-10-08 15:30:00 UTC	31	IN	Data Raw: 32 c5 19 99 98 a0 25 58 e7 bf f7 57 c3 91 07 16 ed 05 f9 7e 38 92 64 2b 7d 96 87 97 06 70 c4 79 e5 af 13 58 aa 2e 55 72 74 68 a2 40 b4 58 9a 3e 90 35 80 a3 af 76 bd 7b a1 ee 43 06 23 07 cc 94 8a 8b 8b 50 22 f6 97 58 84 95 97 d8 86 8c f4 34 d4 a2 73 e7 8f c5 80 41 d6 9d cb 56 70 a2 81 09 47 a6 b0 61 57 a5 ba bc 88 71 7d 8f a6 e8 d6 d9 73 8c c7 79 7d bf f9 0a 75 61 10 17 3f b4 71 b3 56 94 af cc ed ed f3 9c 3b 78 f4 e2 52 f4 f7 23 f0 ff 5d f0 3a 30 81 f0 0e 03 bf ac 1d 17 1a da 54 b6 62 be ef 53 f1 d7 a0 e7 b0 21 72 a2 b4 a0 dc d3 1e bb 06 03 e1 9a 77 d8 18 68 49 80 78 b0 c2 03 5f 41 92 88 2a ec 24 ef 5d bd 0e 65 67 64 96 3c c2 fa 77 e0 e8 ef 50 9b 9e 3d 3f 96 03 06 4b 41 04 f5 1a 3e b2 ca cf 93 ff 92 7d cc a8 e4 05 9c 68 c0 c6 d6 3f 98 71 45 62 73 64 76 0e Data Ascii: 2%XW~8d+}pyX.Urth@X>5v{C#P"X4sAVpGaWq}sy}ua?qV;xR#]:0TbS!rwhIx_A*$]egd<wP=?KA>}h?qEbsdv
2021-10-08 15:30:00 UTC	33	IN	Data Raw: 88 80 29 39 c8 53 b8 79 34 41 f5 3d 3c 24 16 89 40 e9 48 db e1 cd ab 57 e8 c1 e5 7f d0 03 bc 6b cf a4 58 04 7a ff 0e 78 2f 01 98 7f 76 56 a6 c4 00 a8 a6 fc 42 94 85 8f 81 91 71 71 eb af 3f 73 d9 e6 e9 f9 ae ac bc 5c a5 6b 7c 20 7e 3e c1 f3 41 c8 c3 87 ad b9 6a 80 2e 94 03 d3 5f ef 53 7f 11 77 b1 e1 9c fc ca 5f bc 1e 05 b3 86 10 e4 26 6a 60 93 db 35 f0 51 aa e4 b7 6e 5d 54 0d 0b 13 81 cc 00 9f 01 4e 67 82 b0 2c 41 e0 b3 67 e8 29 36 da 51 f2 b5 e7 b3 4e 3e cb ae dd ba f5 83 ff ed f4 6e cb 67 1d b2 65 33 1f 80 ca e6 e4 e8 de a1 76 fd 61 d1 01 01 a1 d9 69 69 bc 8a 21 73 44 ae 46 8a 49 c4 c6 29 c0 e6 a0 47 c7 0e 72 f5 0d c4 06 2e 40 f3 2f 3f 2f 4f 2e 4d 28 11 40 1b 68 59 4a 6b 5a c2 86 22 f8 62 84 9d 7b 70 c9 06 86 56 e0 de c6 de 1e 99 59 59 e0 f5 bd 25 de 64 Data Ascii: )9Sy4A=<$@HWkXzx/vVBqq?s\k\| ~>Aj._Sw_&j`5Qn]TNg,Ag)6QN>nge3vaii!sDFI)Gr.@/?/O.M(@hYJkZ"b{pVYY%d
2021-10-08 15:30:00 UTC	34	IN	Data Raw: c3 35 1b 36 ea 20 c4 c1 0f 64 0a 6e 09 50 82 dd d3 ab 97 13 bb 7d 3b 32 31 f6 cd db be 78 2e 29 c8 99 4a 09 ad 9a fa 4d 8e 4f c0 e6 b7 c3 b0 0d c1 6e b8 4a 79 48 c0 f2 31 78 f4 01 03 23 81 be cf 39 b3 21 00 2a bb 63 e7 cd 45 83 c6 8d 66 54 ec 01 0f 3f 6b 67 cc e2 7d 06 a2 29 ac b9 a8 07 1c 7b 45 8d 5a d0 00 00 09 c1 49 44 41 54 36 ec de 65 da 1f cb 7f ba c8 45 79 7c 94 21 58 06 00 8d 7d 71 fb fa bf 1d bf 18 de 2e 31 3c a2 36 1f 8d 17 63 99 d1 d8 d5 75 3a 76 6c 01 be fb 48 4c 00 da 54 13 5b e6 e9 88 8f e7 12 de bf 47 e0 1a 9b 4d 00 0b c1 b3 d6 af 43 75 9b 34 62 2c 06 66 25 5e b3 e6 60 3b 8a cf 18 f3 94 c7 84 7a ed db fd 73 c4 eb d7 69 42 6e bb fc 67 44 60 d4 c2 7e 40 bf ef a6 06 45 bc 78 4e 37 05 a5 de 4d 87 fe 7d b0 0f c3 05 f8 8b ac 98 87 07 3f 7f 81 6e Data Ascii: 56 dnP};21x.)JMOnJyH1x#9!*cEfT?kg}){EZIDAT6eEy\|!X}q.1<6cu:vlHLT[GMCu4b,f%^`;zsiBngD`~@ExN7M}?n
2021-10-08 15:30:00 UTC	35	IN	Data Raw: 0b e5 96 01 00 c0 92 25 c1 f7 f3 ce 84 3c 78 d8 af b0 80 ea 11 68 aa d3 09 a1 1e 70 d1 5d bb 4d eb f3 27 7e 5f 3d a0 bc 7d f5 a5 f1 2f d7 0c a0 04 88 31 4b bc bb 85 bf f2 3d 1a 1b f4 c6 ae 24 8e fe ea 2e 02 0e ae 75 12 aa bb 7b 0c ff 63 89 e7 35 dd 6d a5 72 2d a3 0c 40 0a a7 e1 b3 96 ac 7b f7 ef bf d3 33 53 92 f5 a5 a2 e9 a5 8e 20 60 6a 65 5d e0 d2 b2 e5 86 c3 eb 97 30 bb 34 d6 91 b6 2a db 0c ca 00 64 90 9a ee e3 e3 f0 f6 55 e8 99 b0 27 4f 5b d0 93 02 19 70 44 7a 0b 3b fc 35 9a 37 7b ec e2 5e 6b c0 86 19 33 62 45 da 0c 5e c8 a6 0c 80 01 d6 51 f3 57 0f 8c f0 7f b1 2f 2e 34 b4 6c 03 f9 0c 65 d0 68 ed 23 60 5f ab 56 8a 73 a3 c6 a3 f6 fd 3a ef b4 f6 a9 11 1e 05 94 01 94 f1 4e 86 4f 5b b4 3d e4 c9 a3 f1 39 e9 e9 e5 ea c8 b4 0c 58 04 9f 6c 64 6e 5e 54 bb 79 ab Data Ascii: %<xhp]M'~_=}/1K=$.u{c5mr-@{3S `je]04*dU'O[pDz;57{^k3bE^QW/.4leh#`_Vs:NO[=9Xldn^Ty

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: VisBridge-1.0.4+Setup.exe PID: 3260 Parent PID: 2812

General

Start time:	17:28:01
Start date:	08/10/2021
Path:	C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\VisBridge-1.0.4+Setup.exe'
Imagebase:	0xb70000
File size:	86984728 bytes
MD5 hash:	B33F67F583B9C1F1F726D15B249D4242
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: Update.exe PID: 6888 Parent PID: 3260

General

Start time:	17:28:24
Start date:	08/10/2021
Path:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\SquirrelTemp\Update.exe' --install .
Imagebase:	0x9a0000
File size:	1830120 bytes
MD5 hash:	C45A02058073AEB5783F40F78CBF6130
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 2%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: squirrel.exe PID: 5744 Parent PID: 6888

General

Start time:	17:29:20
Start date:	08/10/2021
Path:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\Squirrel.exe' --updateSelf=C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
Imagebase:	0xdf0000
File size:	1830120 bytes
MD5 hash:	C45A02058073AEB5783F40F78CBF6130
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: VisBridge.exe PID: 5824 Parent PID: 6888

General

Start time:	17:29:22
Start date:	08/10/2021
Path:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --squirrel-install 1.0.4
Imagebase:	0x7ff7b8200000
File size:	123533032 bytes
MD5 hash:	921F9BAD8A3988D0DF1B9C3255C7DB7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: VisBridge.exe PID: 6280 Parent PID: 6888

General

Start time:	17:29:39
Start date:	08/10/2021
Path:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --squirrel-firstrun
Imagebase:	0x7ff7b8200000
File size:	123533032 bytes
MD5 hash:	921F9BAD8A3988D0DF1B9C3255C7DB7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: VisBridge.exe PID: 5992 Parent PID: 6280

General

Start time:	17:29:56
Start date:	08/10/2021
Path:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=gpu-process --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1448 /prefetch:2
Imagebase:	0x7ff7b8200000
File size:	123533032 bytes
MD5 hash:	921F9BAD8A3988D0DF1B9C3255C7DB7F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: VisBridge.exe PID: 6880 Parent PID: 6280

General

Start time:	17:30:13
Start date:	08/10/2021
Path:	C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe
Wow64 process (32bit):
Commandline:	'C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1400,12772066658251633810,10865256888400890998,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1812 /prefetch:8
Imagebase:
File size:	123533032 bytes
MD5 hash:	921F9BAD8A3988D0DF1B9C3255C7DB7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: squirrel.exe PID: 5744 Parent PID: 6888 squirrel.exeCOMMON

Execution Graph

Execution Coverage:	28.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7%
Total number of Nodes:	43
Total number of Limit Nodes:	2

Executed Functions

Function 01A242E8, Relevance: 2.4, Strings: 1, Instructions: 1105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=, xrefs: 01A24B73

Memory Dump Source

Source File: 00000017.00000002.517335357.0000000001A20000.00000040.00000001.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1a20000_squirrel.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: 98566d0f3b3f412df2f7d08e3b4c5368127570b0af8b15d4d018e4f0e5f06c98
Instruction ID: 256d235a10a0d146f3a66a2ebd41d771207897161db5649c7377697796ea2804
Opcode Fuzzy Hash: 98566d0f3b3f412df2f7d08e3b4c5368127570b0af8b15d4d018e4f0e5f06c98
Instruction Fuzzy Hash: 4092D334B002258FCB15DFB8C850AAEBBB7FF89214B54896ED405AB351DB34DD45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A26429, Relevance: 1.6, APIs: 1, Instructions: 60
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 01A264AF

Memory Dump Source

Source File: 00000017.00000002.517335357.0000000001A20000.00000040.00000001.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1a20000_squirrel.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 3894e3b82647ad74283bcd125aee93a9fd679efcdc67e892db2ae91167fdd994
Instruction ID: 2088c98954b6c33632ffe64a329f4283c8ae5b6bf35c999d41a4745ce59680da
Opcode Fuzzy Hash: 3894e3b82647ad74283bcd125aee93a9fd679efcdc67e892db2ae91167fdd994
Instruction Fuzzy Hash: AA21EDB5D01258DFCB10CFAAD984ADEFBF5BB48350F10882AE958A7310D335A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A26430, Relevance: 1.6, APIs: 1, Instructions: 58
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 01A264AF

Memory Dump Source

Source File: 00000017.00000002.517335357.0000000001A20000.00000040.00000001.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1a20000_squirrel.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: aceea0a1cb28ecdc8b967827d6179a7ed46d8f5ea5b7d2076f07b085571ef466
Instruction ID: de45516832f789409083a5cc869d1ec4932e562abc911d62dabc35beb8ad191a
Opcode Fuzzy Hash: aceea0a1cb28ecdc8b967827d6179a7ed46d8f5ea5b7d2076f07b085571ef466
Instruction Fuzzy Hash: 8C21CFB5901258DFCB10CF9AD884ADEFBF5BB48350F14842AE918A7310D375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A264F0, Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,00000000,00000000,?,?,01A26242,01A26256), ref: 01A26557

Memory Dump Source

Source File: 00000017.00000002.517335357.0000000001A20000.00000040.00000001.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1a20000_squirrel.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 5a8e54d472eca28cbd4605e66049df0ae20019e889ce3c3937e1ae8e057ec61b
Instruction ID: cbf71ecd9a32e2ad85373a370ca6565a92691524869f7f607228fbc447ea8c2a
Opcode Fuzzy Hash: 5a8e54d472eca28cbd4605e66049df0ae20019e889ce3c3937e1ae8e057ec61b
Instruction Fuzzy Hash: 1D1146B1800219CFDB10CFA9D5447EEBBF4EF48364F14882AD418A7740C738A545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A25E58, Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,00000000,00000000,?,?,01A26242,01A26256), ref: 01A26557

Memory Dump Source

Source File: 00000017.00000002.517335357.0000000001A20000.00000040.00000001.sdmp, Offset: 01A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_1a20000_squirrel.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8fc853b6a6e92454c8ee78986bd143cb10e27c2c64a7ceb7c7f8a6ee5ee073c5
Instruction ID: 1191a99defcf4d3c4644d491b230b6e19d396dda106c56701fc7b2b8b7e133e1
Opcode Fuzzy Hash: 8fc853b6a6e92454c8ee78986bd143cb10e27c2c64a7ceb7c7f8a6ee5ee073c5
Instruction Fuzzy Hash: 751158B1800219CFCB10CF9AD484BEEBBF4EF48324F14842AD918A7340D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 016AD0D9, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.517103075.00000000016AD000.00000040.00000001.sdmp, Offset: 016AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_16ad000_squirrel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52f1bf0e7dd7e8cf72aa456d146c8191d15ef473f6a8d1d245348e91816825f
Instruction ID: e4ded0e06e387bc2d899e763ea9e72625870a6700e06d4732c2ba967fea69cf8
Opcode Fuzzy Hash: a52f1bf0e7dd7e8cf72aa456d146c8191d15ef473f6a8d1d245348e91816825f
Instruction Fuzzy Hash: 8301F771408344DAEB104A96CC84BA7FBDCEF45269F58895EED081AB42D375AC45CEB1

Uniqueness

Uniqueness Score: -1.00%

Function 016AD0D8, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.517103075.00000000016AD000.00000040.00000001.sdmp, Offset: 016AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_16ad000_squirrel.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e23eb002341722aeb01cbeb30add2b2159c8e94697b56f69b411202e25b17ca
Instruction ID: 224f367d7f36426b1c087a92a5841c09dc70018ee56740a6fa236a352fd880be
Opcode Fuzzy Hash: 1e23eb002341722aeb01cbeb30add2b2159c8e94697b56f69b411202e25b17ca
Instruction Fuzzy Hash: 0FF0C2B1404344DAEB118A5ADCC4BA2FFE8EF41634F18C55AED084F782C379AC44CAB0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Users\user\AppData\Local\SquirrelTemp\background.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Users\user\AppData\Local\SquirrelTemp\background.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\squirrel.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\Update.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\package.json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\package.json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\package.json VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\main.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\main.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\main.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\node.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\node.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\node.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\debug.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\debug.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\debug\src\debug.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\ms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\ms\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\ms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\ms\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\resources\app\node_modules\electron-squirrel-startup\node_modules\ms\index.js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\VisBridge\app-1.0.4\VisBridge.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	DLL monitoring, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used or give context to information collected by a keylogger.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report VisBridge-1.0.4+Setup.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

Privilege Escalation:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Function 01A242E8, Relevance: 2.4, Strings: 1, Instructions: 1105
COMMON

Function 01A26429, Relevance: 1.6, APIs: 1, Instructions: 60
nativeCOMMON

Function 01A26430, Relevance: 1.6, APIs: 1, Instructions: 58
nativeCOMMON

Function 01A264F0, Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Function 01A25E58, Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre